The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documentation outlines a process for managing App Store metadata using dynamic JavaScript configuration files (store.config.js). This approach allows the inclusion of data fetched from external APIs, which creates a surface for tool output poisoning if the remote data source contains malicious instructions.\n
Ingestion points: references/app-store-metadata.md (via fetch() calls within configuration scripts).\n
Boundary markers: Absent; the documentation provides examples of fetching external content without specific delimiters or instructions to ignore embedded commands.\n
Capability inventory: The skill uses eas-cli for high-privilege operations, including binary uploads and metadata updates to production app stores as described in SKILL.md.\n
Sanitization: Absent; the provided examples do not include validation or sanitization logic for content retrieved from external localization services.\n- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute the submit-expo-feedback package using npx --yes. This pattern involves the runtime execution of code retrieved directly from the npm registry.\n- [EXTERNAL_DOWNLOADS]: The skill involves downloading the eas-cli utility and suggests fetching external resources for metadata configuration. These downloads are associated with the vendor's official deployment tooling.\n- [COMMAND_EXECUTION]: The skill relies on several CLI utilities, including eas, npx, plutil, and sips, to perform build verification, metadata updates, and storefront submissions.\n- [DYNAMIC_EXECUTION]: The use of store.config.js allows for the execution of arbitrary JavaScript to dynamically generate configuration values or fetch translations at runtime, which is a standard but powerful feature of the EAS metadata tool.

eas-app-stores