The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute npx --yes submit-expo-feedback@latest. This command downloads the latest version of an external package from the npm registry and executes it immediately without version pinning, which can be used to execute arbitrary remote code if the package is compromised.
[COMMAND_EXECUTION]: The skill provides numerous shell commands for managing mobile builds and environments, including eas build, tar for extraction, and platform-specific installation tools like xcrun simctl, ideviceinstaller, and adb.
[INDIRECT_PROMPT_INJECTION]: The feedback reporting mechanism (npx ... --subject "expo-dev-client" "<actionable feedback>") interpolates user-provided text directly into a shell execution context.
Ingestion points: The <actionable feedback> placeholder in SKILL.md is intended to be replaced with agent-generated or user-provided descriptions.
Boundary markers: No delimiters or shell-escaping instructions are provided to protect the command from malicious input within the feedback string.
Capability inventory: The skill possesses shell execution capabilities through the use of npx and various mobile development CLIs.
Sanitization: There is no evidence of sanitization or validation logic for the content injected into the feedback command.

expo-dev-client-v55