The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses npx to execute @tanishqkancharla/diffmap for listing, serving, and sharing specifications. It also invokes git diff to capture code changes.
[EXTERNAL_DOWNLOADS]: The skill triggers the download of the @tanishqkancharla/diffmap package from the NPM registry during execution. This resource is associated with the skill's author.
[DATA_EXFILTRATION]: The share functionality uploads local specification files, which can include sensitive implementation details and code diffs, to https://diffmap.dev. The documentation indicates these uploads are unlisted but publicly accessible.
[INDIRECT_PROMPT_INJECTION]: The skill permits the creation of html fences within specifications. The instructions explicitly state that this HTML is not sanitized and is trusted by the diffmap viewer, which could be exploited if malicious content is injected into the spec by an external party.
Ingestion points: User-provided plans, requirements, and existing repository source code in SKILL.md.
Boundary markers: None present for the html block content.
Capability inventory: File system write (specs/, tmp/), shell execution (npx, git), and network transmission (diffmap share).
Sanitization: Explicitly absent for HTML content rendered by the tool.

generate-spec