The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute npx --yes submit-expo-feedback@latest to provide feedback. This command downloads and executes a package from the NPM registry that is not an official tool from the Expo team nor belongs to the skill author's namespace (@blockmatic). This presents a significant risk of arbitrary code execution.
[REMOTE_CODE_EXECUTION]: In the documentation for verifying the new architecture, the skill suggests running bunx xcobra. xcobra is an unverified third-party dependency not recognized as a standard utility in the React Native ecosystem, which could be used to execute malicious payloads.
[INDIRECT_PROMPT_INJECTION]: The skill processes multiple project configuration and source files which may be controlled by an attacker or sourced from an untrusted repository.
Ingestion points: The agent is instructed to read package.json, app.json, babel.config.js, metro.config.js, postcss.config.js, and the contents of the patches/ directory.
Capability inventory: The skill uses high-privilege commands including recursive file deletion (rm -rf node_modules .expo), native build directory regeneration (npx expo prebuild --clean), and automated code modification (npx expo-codemod).
Boundary markers: There are no protective delimiters or instructions to prevent the agent from following directives embedded within the project files it reads.
Sanitization: No sanitization or schema validation is applied to the ingested configuration data before it influences the agent's logic or command arguments.
[COMMAND_EXECUTION]: The skill makes extensive use of powerful shell commands such as watchman watch-del-all and rm -rf. While these are standard in mobile development troubleshooting, their inclusion in an automated skill that processes untrusted data increases the potential impact of a successful injection attack.

expo-upgrading-v55