The Agent Skills Directory

[SAFE]: The skill incorporates clear security guidelines, instructing the agent to never commit keystores, certificates, or mobile provisioning profiles to the repository.
[SAFE]: The provided scripts/verify.sh is a read-only utility script that performs local audits for security and configuration best practices. It checks for plaintext secrets in configuration files and ensures signing materials are not tracked by git.
[DYNAMIC_EXECUTION]: The verify.sh script utilizes node -e and python3 -c to validate JSON syntax in eas.json. This is a routine and safe method for verifying file integrity on the local file system without executing untrusted logic.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process configuration data from app.json and eas.json. It includes mitigation measures such as the verify.sh tool to audit these files for suspicious content and ensures the shipping pipeline follows strict, predefined commands (prebuild, build, submit, update).

expo