The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data such as git diffs, PR content, and file source code while maintaining capabilities like filesystem writing, shell command execution, and network communication. This creates a surface for indirect prompt injection where malicious instructions embedded in code comments or PR descriptions could attempt to influence the agent's behavior during the summarization process.
Ingestion points: The skill reads local diffs, source files, and conversation context in SKILL.md and references/local-files.md.
Capability inventory: The skill executes shell commands via npx, writes local MDX files to the 'plans/' directory, and sends data to the Plan MCP server (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat diff content as untrusted data distinct from operational instructions.
Sanitization: The skill contains explicit instructions to redact hardcoded secrets (e.g., API keys, tokens) from generated summaries, which serves as a mitigation for data exposure but does not address instruction injection.
[COMMAND_EXECUTION]: The skill relies on executing several shell commands to collect data and manage local plan previews. These commands involve the vendor's own CLI tools.
Evidence: SKILL.md and README.md reference executing 'npx @agent-native/core@latest recap collect-diff', 'npx @agent-native/core@latest plan local check', 'npx @agent-native/core@latest plan local serve', and 'npx @agent-native/core@latest plan blocks'.
[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute packages from the public npm registry.
Evidence: README.md and SKILL.md instruct the agent to use 'npx @agent-native/skills@latest' and 'npx @agent-native/core@latest'.
[DATA_EXFILTRATION]: The skill summarizes project data and uploads it to the vendor's platform to provide interactive review surfaces.
Evidence: SKILL.md describes publishing recaps to 'plan.agent-native.com' via the 'create-visual-recap' tool on the Plan MCP connector. This is the intended behavior for the skill's hosted mode.

visual-recap