The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill uses the ZOODATA_API_KEY for authentication. The bundled CLI tool, zoodata.py, correctly handles this credential by only transmitting it to trusted hosts (zoodata.ai, its subdomains, or localhost). It supports standard secret management by reading from environment variables or a local configuration file in the user's home directory (~/.zoodata/config.json).
[COMMAND_EXECUTION]: The skill executes a bundled Python script (zoodata.py) to interface with the ZooData API. This script implements an internal allowlist (allowed-commands.json) that restricts the subcommands the agent can invoke, preventing arbitrary execution of other utility functions within the script.
[EXTERNAL_DOWNLOADS]: The skill performs read-only network requests to api.zoodata.ai. These requests are used to fetch keyword demand, market structure, and product traffic data. The skill documentation explicitly prohibits the use of external browser automation or direct Amazon navigation, relying solely on the vendor's documented API endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill ingests public Amazon product data via the ZooData WebTools scraping service. To mitigate risks associated with untrusted content, the skill defines extensive "Source-of-truth boundaries" and "Evidence Protocols" in execution-guide.md and evidence-protocols.md. These protocols ensure the agent classifies and validates data within specific evidence levels (Market, Subject, or Seller-real) before making claims.
[REMOTE_CODE_EXECUTION]: While the API documentation mentions support for interactive scraping including JavaScript execution via the scrape-interactive endpoint, this functionality is confined to the remote acquisition surface and is not used to execute code within the local agent environment.

amazon-keyword-traffic-analysis