The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and analyze simulator logs and crash reports, creating a surface for untrusted data ingestion.
Ingestion points: The sim_api /logs and sim_api /crashes routes in references/logs-and-crashes.md fetch content directly from the remote simulator environment.
Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions that may be embedded in processed log data.
Capability inventory: The skill has access to shell execution via Bash, network utilities like curl, and the ability to run arbitrary packages via npx.
Sanitization: No explicit sanitization or filtering of the ingested log content is described before processing by the agent.
[REMOTE_CODE_EXECUTION]: The skill relies heavily on npx --yes to fetch and execute CLI tools including eas-cli, agent-device, expo, and submit-expo-feedback at runtime, creating a dependency on the external NPM registry.
[COMMAND_EXECUTION]: The simulator:exec command is used to execute arbitrary shell commands within a session-specific environment, and the skill also invokes local build tools like xcodebuild and pod install.
[EXTERNAL_DOWNLOADS]: Application artifacts are downloaded from the vendor's domain (expo.dev) using curl and the agent-device install-from-source command.
[PROMPT_INJECTION]: Instructions in references/run-your-app.md regarding "Tunnel scope and approvals" direct the agent to carry initial user consent as persistent "existing authorization" for subsequent high-risk actions like starting tunnels and fetching code, which could reduce user oversight during the session.

eas-simulator