visual-plan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required hosted Plan MCP workflow for /visual-plan, the agent can ingest and pass user-provided “source plan” text (from the user's paste, referenced file, or visible agent context) as planText into the create-visual-plan/mode-matched create tools (and later reads anchorDetails/comments via get-plan-feedback), creating an outsider free-text injection surface.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly directs the agent/client to connect to the hosted Plan MCP connector (https://plan.agent-native.com and https://plan.agent-native.com/mcp), a runtime external endpoint that provides MCP tools/actions the agent calls (i.e., remote tool executions) which the skill relies on for hosted mode.