The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of dependencies from well-known registries such as npm, Maven, and CocoaPods. It references repositories from established organizations including Microsoft, Google, and the plugin vendor's own verified registry at 'npm.registry.capawesome.io'. These operations are essential components of the mobile development lifecycle.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes local project files (e.g., 'package.json', platform folders) to auto-detect the configuration. This behavior represents a surface for indirect prompt injection if project files contain malicious instructions. However, the resulting actions (package installation, configuration updates) are standard developer tasks and do not grant unauthorized access to sensitive system resources.
Ingestion points: Project configuration files such as 'package.json', 'android/', and 'ios/' directories (SKILL.md).
Boundary markers: Absent; the skill relies on the agent to interpret project files directly.
Capability inventory: Execution of installation commands ('npm install', 'pod install') and native project synchronization ('npx cap sync').
Sanitization: Not explicitly performed; the skill assumes the local project environment is controlled by the user.
[CREDENTIALS_UNSAFE]: The skill instructs the user to configure an npm registry using an authorization token. The instructions correctly direct the user to provide their own license key as an environment variable or config setting rather than hardcoding any secrets, which aligns with secure credential management practices.

capacitor-plugins