visual-plan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime path for this skill (/visual-plan → hosted Plan MCP connector tools like get-plan-feedback/get-plan-blocks/update-visual-plan) can ingest untrusted human comment text from shared/outsider reviewers via the Plan app’s feedback threads, before the agent filters which comments to act on.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to use the hosted Plan MCP connector at https://plan.agent-native.com/_agent-native/mcp (and to connect to https://plan.agent-native.com), which will be contacted at runtime and provides the MCP tools the agent relies on to publish/read plans and drive tool-based actions.