The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides a static analysis tool, scripts/mobile_audit.py, which reads and processes external source code files to identify design and performance issues. This creates an indirect prompt injection surface where malicious instructions could be embedded in the data (comments or strings within the code files) being analyzed, potentially influencing the agent's interpretation of the audit results.
Ingestion points: The scripts/mobile_audit.py script reads the contents of files within user-specified directories or file paths.
Boundary markers: Absent; the script reads raw file content into memory for regex matching without applying delimiters or protective framing to distinguish the code data from potential natural language instructions.
Capability inventory: The skill configuration in SKILL.md allows the use of Read, Glob, Grep, and Bash tools. The Python script performs file I/O operations and prints results to stdout.
Sanitization: Absent; the script performs pattern matching on raw text and does not escape or sanitize the content extracted from the files before it is processed or displayed in the output.
[SAFE]: The documentation and guidelines provided (e.g., mobile-performance.md, mobile-backend.md) contain standard industry best practices for mobile development, including security recommendations such as using secure storage for tokens instead of AsyncStorage.
[SAFE]: The Python script scripts/mobile_audit.py uses only standard libraries (sys, os, re, json, pathlib) and does not perform any network operations, dynamic code execution (eval/exec), or persistence-related tasks.

mobile-design