The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute npx --yes submit-expo-feedback@latest in SKILL.md to collect feedback. This command downloads and runs code directly from the NPM registry that is not part of the standard official Expo or EAS toolchain, and the use of the --yes flag bypasses user confirmation.
[DYNAMIC_EXECUTION]: In references/app-store-metadata.md, a dynamic configuration example using store.config.js performs a network request via fetch() to a remote endpoint (https://api.example.com/app-store-copy). This capability allows remote content to be loaded and processed as part of the app's configuration pipeline, posing a risk of malicious content injection.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect injection by ingesting untrusted data from external sources without proper sanitization. Ingestion points include pull request numbers interpolated in references/workflows.md (pr-${{ github.event.pull_request.number }}) and remote translation data in references/app-store-metadata.md. The skill lack boundary markers and possesses powerful capabilities like shell execution and network access, which could be exploited.
[CREDENTIALS_UNSAFE]: The skill manages highly sensitive credentials, including Apple Developer API keys (.p8), Apple ID, and Google Service Account keys (.json). While secure practices are recommended, the instructions also suggest referencing local file paths (e.g., ./google-service-account.json), which increases the surface for accidental exposure or exfiltration.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the eas-cli package and uses npx for various deployment tasks, creating dependencies on external package registries like NPM for critical deployment steps.
[COMMAND_EXECUTION]: The skill provides numerous shell commands for building, submitting, and managing credentials (e.g., npx eas-cli@latest build), giving the agent significant control over the local system for the purpose of mobile app deployment.

expo-deployment-v55