The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install official vendor-owned libraries and tools from standard registries.
Fetches the scavio library (version 0.20.0) from PyPI and NPM.
Executes the Scavio MCP server using npx -y @scavio/mcp-server@0.18.1.
[COMMAND_EXECUTION]: The documentation provides examples for using curl and CLI tools to interact with the vendor's API.
Shell commands are used to set the SCAVIO_API_KEY and perform POST requests to https://api.scavio.dev.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from an external source (Realtor.com API), which presents a potential attack surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through fields like description, features, and reviews returned by the /realtor/property and /realtor/agent endpoints in SKILL.md.
Boundary markers: The skill includes a "Guardrails" section instructing the agent to never fabricate data and to surface the source URL so the user can verify the information.
Capability inventory: The skill's primary capabilities include network requests to the vendor's API (api.scavio.dev) and standard package installations documented in SKILL.md.
Sanitization: There is no explicit mention of sanitization or escaping of the ingested strings before they are presented to the agent, although the skill uses structured JSON envelopes.

realtor-com-property-data