The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to ask the user for their OpenAI API key in plain text. It provides instructions to configure this key using the command snapai config --api-key <their-api-key> and to display the stored key using npx snapai config --show. This pattern causes sensitive credentials to enter the agent's execution context and conversation history.
[REMOTE_CODE_EXECUTION]: The skill relies on npx snapai, which downloads and executes a package from the NPM registry at runtime. The package is maintained by an unverified third-party source, presenting a supply chain risk as it is granted access to the user's API keys and local file system.
[EXTERNAL_DOWNLOADS]: The instructions recommend installing the imagemagick suite via Homebrew (brew install imagemagick) to handle icon processing.
[COMMAND_EXECUTION]: The skill executes various shell commands for environment configuration, directory creation, and image manipulation, including mkdir, cp, magick, sips, and npx expo.

app-icon