The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses execFileSync in several utility scripts (add-registry-component.cjs, install-packages.cjs, run-package.cjs) to automate development tasks. These scripts interact with standard package managers (npm, pnpm, yarn, bun) and CLI tools like expo and shadcn to perform project setup, dependency installation, and component previewing.
[EXTERNAL_DOWNLOADS]: The add-registry-component.cjs script is designed to download UI component metadata and source code from https://reactnativereusables.com. This is a community-standard registry for React Native UI primitives. The script also handles the installation of project dependencies required by these components.
[REMOTE_CODE_EXECUTION]: The component vendoring mechanism (add-registry-component.cjs) can add new TypeScript/JavaScript files to the project and install arbitrary npm packages as defined in the remote registry's JSON metadata. This functionality is a standard part of modern UI component systems like shadcn/ui and is intended for project scaffolding.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by ingests data from external URLs provided by the user to the add-registry-component.cjs script. This data determines the code content and dependencies added to the project.
Ingestion points: The url argument in scripts/add-registry-component.cjs allows the agent to fetch content from arbitrary remote locations.
Boundary markers: None identified in the script logic; the script proceeds to parse and process the retrieved JSON content.
Capability inventory: The skill has the capability to execute shell commands via execFileSync, write files to the local disk using fs.writeFileSync, and perform network operations through the shadcn view subprocess.
Sanitization: Content is parsed as JSON, and basic transformations (like import path rewriting) are applied, but there is no verification of the integrity or safety of the source code provided by the registry.

building-react-native-application