The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill recommends verifying the project's architecture by running bunx xcobra expo eval "_IS_FABRIC".
Evidence: This instruction is located in references/new-architecture.md.
The bunx utility downloads and executes a package in one step. The xcobra package is an obscure third-party utility not associated with a trusted organization or well-known service, nor is it a vendor resource for the skill author 'gigs-slc'. Executing code from an unverifiable source in this manner is a high-risk practice.
[COMMAND_EXECUTION]: The skill uses several commands that perform environment cleanup and project modification.
Evidence: SKILL.md includes rm -rf node_modules .expo, watchman watch-del-all, and npx expo install --fix.
While these are standard commands in the React Native ecosystem, they involve broad filesystem deletions and automatic dependency updates that should be executed with caution.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze and modify project configuration files which could potentially contain malicious content.
Ingestion points: The agent is directed to read and edit app.json, package.json, babel.config.js, and metro.config.js in SKILL.md.
Boundary markers: There are no instructions to use delimiters or to treat the content of these files as untrusted when the agent processes them.
Capability inventory: The skill has the capability to write files and execute network-enabled installation commands (npx expo install).
Sanitization: No sanitization or validation of the input configuration files is described, creating a surface for potential injection if a file contains instructions disguised as data.

upgrading-expo