The Agent Skills Directory

[SAFE]: The skill provides extensive documentation for cross-platform mobile development using Capacitor. No malicious patterns or security risks were identified.
[EXTERNAL_DOWNLOADS]: The skill references standard development tools and libraries from trusted sources.
Mentions official Capacitor plugins (@capacitor/*) and community plugins (@capacitor-community/*).
References vendor-specific tools from capawesome-team (@capawesome/*, @capawesome-team/*), which align with the skill's author context.
Includes instructions for installing well-known development dependencies such as cocoapods, cypress, playwright, and appium.
Provides a reference to a Gradle distribution URL from the official services.gradle.org domain.
[COMMAND_EXECUTION]: The skill documents standard Capacitor and native development CLI commands (e.g., npx cap sync, npx cap run, pod install, ./gradlew assembleRelease). These are standard operations for the described developer workflow.
[INDIRECT_PROMPT_INJECTION]: The skill instructions specify that the agent should auto-detect project configuration by reading local files like package.json and capacitor.config.ts. While this constitutes an ingestion surface for untrusted local data, it is a standard requirement for development tools and is used here for benign configuration detection.
[SECURITY_BEST_PRACTICES]: The skill includes a dedicated security.md reference that correctly advises users on several critical security topics:
Warning against embedding secrets (API keys, credentials) in client-side code.
Recommending native secure storage (Keychain/Keystore) via encrypted plugins for sensitive data.
Recommending the use of HTTPS and Content Security Policy (CSP).
Advising to disable WebView debugging in production builds.

capacitor-app-development