The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The launcher script scripts/asc.mjs is designed to download the appstore-release CLI tool from a remote GitHub repository (https://github.com/beydemirfurkan/appstore-release.git) and execute it using the Node.js runtime. This mechanism allows for the execution of code not contained within the skill's distribution package.
[DYNAMIC_EXECUTION]: The skill supports an --expo-config flag which, as described in SKILL.md, executes dynamic JavaScript or TypeScript configuration files (app.config.js/ts) within the user's project directory by running npx expo config. This involves executing code provided by the user as part of the analysis process.
[COMMAND_EXECUTION]: The skill uses child_process.spawnSync to invoke system commands, including git for repository cloning and node to run the resolved CLI tool. It also triggers npx when the --expo-config flag is used.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes external, untrusted data including iOS project configuration files (app.json, Info.plist) and source code. This creates a surface where malicious content embedded in these files could attempt to influence the agent's logic.
Ingestion points: Reads project files such as app.json, Info.plist, PrivacyInfo.xcprivacy, and source code.
Boundary markers: No explicit boundary markers or sanitization logic for ingested file content is mentioned in the provided instructions.
Capability inventory: The skill has the ability to execute shell commands and run local/downloaded code via scripts/asc.mjs.
Sanitization: No specific sanitization or filtering of the content read from the project files is described.

app-store-preflight