The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the agent to execute chmod +x on the dynamically generated shell scripts scripts/build-android.sh and scripts/build-ios.sh. Modifying permissions on files created at runtime is a privileged operation that increases the potential impact of any errors in the script generation process.
[COMMAND_EXECUTION]: The skill invokes several shell commands, including npx expo prebuild and chmod. While npx expo targets a well-known service, executing these commands directly allows the skill to modify the local file system and environment.
[DYNAMIC_EXECUTION]: The skill generates two shell scripts by interpolating project-specific metadata into hardcoded templates. These scripts are then marked as executable and designed to be run locally, which is a form of runtime script generation and execution.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection through the following evidence chain:
Ingestion points: The skill reads project configuration data from app.json, app.config.ts, and app.config.js (SKILL.md, Step 1).
Boundary markers: None are present; the skill interpolates literals directly into shell script templates.
Capability inventory: The skill can perform file writes, modify permissions (chmod), and execute commands (npx expo prebuild).
Sanitization: There is no evidence of sanitization or validation of the values extracted from the project configuration before they are placed into shell scripts. An attacker-controlled app.json could potentially inject malicious shell commands into the generated scripts.

local-build