The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use shell commands such as rm -rf ios, mkdir, and cp. Although rm -rf is a destructive command, its use is transparently documented as necessary for re-scaffolding the project during migration. The skill mitigates risk by requiring the user to have a clean Git working tree before execution.
[INDIRECT_PROMPT_INJECTION]: The skill parses local project files including package.json and project.pbxproj to inventory plugins and extract signing configurations. While this represents a data ingestion surface, the skill does not execute instructions contained within these files, and the data is used strictly for project configuration.
[SAFE]: The skill follows security best practices by creating a temporary local backup (.spm-migration-backup/) of critical files like Info.plist and GoogleService-Info.plist and ensuring this directory is added to .gitignore to prevent sensitive credentials from being committed to version control.

capacitor-app-spm-migration