The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses os.environ.get("ZILLAPI_KEY") to retrieve the API key, which is a standard and recommended practice for managing sensitive credentials.
[REMOTE_CODE_EXECUTION]: All network requests are made to a fixed, vendor-controlled domain api.zillapi.com using standard library tools (urllib). There is no dynamic execution of remote scripts or unverified code.
[DATA_EXFILTRATION]: Data access is limited to the vendor's API endpoints and uses the user-provided API key for authorization. There is no evidence of accessing sensitive local files or transmitting data to unauthorized third parties.
[PROMPT_INJECTION]: The instructions in SKILL.md provide clear guidance on when the agent should trigger tool calls, focusing on explicit user requests and credit consumption, which helps prevent unintended tool usage.

zillow-full