The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute the @tanishqkancharla/diffmap package from the NPM registry.
[COMMAND_EXECUTION]: Executes shell commands including npx @tanishqkancharla/diffmap (list, serve, share) and git diff to generate and manage documentation specs.
[DATA_EXFILTRATION]: The share command uploads specification content, which includes repository paths and code changes extracted via git diff, to the external domain diffmap.dev.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process and render technical specifications that may contain untrusted data from repository diffs.
Ingestion points: Documentation files in the specs/ directory and code outputs from git diff commands.
Boundary markers: No specific delimiters or instructions are provided to the agent to distinguish between documentation content and potential instructions embedded in the code diffs.
Capability inventory: Shell command execution via npx, local web server hosting, and network-based data sharing.
Sanitization: The instructions explicitly note that the html fence used in spec files is "unsanitized," creating a potential Cross-Site Scripting (XSS) or injection surface if the content is rendered by the tool or processed by the agent.

code-walkthrough