The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to use bunx --bun postplan, which dynamically fetches and executes the postplan package from the NPM registry during operation.
[COMMAND_EXECUTION]: The skill uses multiple shell-based commands to manage the PostPlan CLI, including whoami, auth set, auth login, upload, and list. It also suggests spawning a local server using python3 -m http.server as a fallback delivery method.
[DATA_EXFILTRATION]: The skill's primary purpose is the transmission of local HTML files to the external domain https://postplan.dev. While it includes specific instructions for the agent to redact secrets and .env files before transmission, it remains a tool for moving local workspace data to a third-party service.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by processing external data and having network capabilities.
Ingestion points: The skill reads local files designated by the user or agent, specifically ./path/to/draft.html (SKILL.md).
Boundary markers: There are no explicit delimiters or boundary markers used when processing the HTML content for upload.
Capability inventory: The skill utilizes command execution via bunx and network transmission via the upload command (SKILL.md).
Sanitization: The skill relies on natural language instructions for the agent to redact sensitive information manually; no programmatic sanitization or validation of the HTML content is performed prior to upload.

postplan