The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses dynamic context injection (!command syntax) in SKILL.md to execute shell commands when the skill is loaded.
Evidence: It runs a Node.js one-liner (node -e "...") to parse the local package.json and filter for specific dependencies (Capacitor, Firebase, Sentry, etc.).
Evidence: It executes a find command to locate project-specific files like Info.plist, PrivacyInfo.xcprivacy, and capacitor.config.json.
Context: While these commands are functional for the audit, executing complex scripts at load time is a medium-risk pattern.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from a user's local project environment.
Ingestion points: The agent is instructed to read package.json, Info.plist, capacitor.config.*, and PrivacyInfo.xcprivacy (File: SKILL.md, Step 3).
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the content of these files as data rather than instructions.
Capability inventory: The skill assumes the agent can execute shell commands like asc, ffmpeg, codesign, and plutil (File: references/rules/metadata/accurate_metadata.md, references/rules/entitlements/unused_entitlements.md).
Sanitization: No sanitization or validation logic is defined for the ingested file content.
[COMMAND_EXECUTION]: The skill instructions frequently suggest the use of external CLI tools to perform technical audits.
Evidence: Mentions asc (App Store Connect CLI), ffmpeg for video frame analysis, plutil for property list parsing, and codesign for entitlement verification.

capacitor-apple-review-preflight