The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file contains instructions to execute npx --yes submit-expo-feedback@latest. This command downloads and runs code from the npm registry at runtime. The package is not an official Expo utility, despite the skill claiming it is used to 'report it so Expo can improve'.
[REMOTE_CODE_EXECUTION]: The references/new-architecture.md file encourages the use of bunx xcobra expo eval "_IS_FABRIC". The xcobra package is an unknown, third-party tool that is not a standard part of the Expo or React Native ecosystem, posing a risk of executing malicious code when invoked with bunx.
[METADATA_POISONING]: The feedback mechanism in SKILL.md uses deceptive language, stating that feedback is sent so 'Expo can improve'. However, the tool submit-expo-feedback does not belong to the official @expo or expo namespaces, potentially leading to unauthorized data collection or exfiltration of user/agent feedback.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external project files (e.g., package.json, app.json, and source code) to perform upgrades and apply codemods. This creates a vulnerability surface where malicious instructions embedded in a project's configuration or code could influence the agent's behavior during the upgrade process.
Ingestion points: Project configuration files (app.json, package.json, babel.config.js) and source code files.
Boundary markers: None present; the skill treats project content as data for transformation without explicit sanitization.
Capability inventory: Shell command execution (npx, rm, watchman), file system modification (expo-codemod), and network access via feedback tools.
Sanitization: Not observed.
[COMMAND_EXECUTION]: The skill requires the agent to perform multiple high-risk shell operations, such as rm -rf node_modules .expo and watchman watch-del-all. While common in development, these commands are executed alongside the remote code execution patterns, increasing the overall risk profile.

expo-upgrading-v55