The Agent Skills Directory

[COMMAND_EXECUTION]: The skill guides the agent to perform various shell-based operations, including generating JavaScript bundles using npx react-native bundle, analyzing them with npx source-map-explorer, and profiling app performance via agent-device react-devtools. These are standard developer operations performed in a local or CI environment.
[INDIRECT_PROMPT_INJECTION]: The skill involves an attack surface for indirect prompt injection as it ingests and processes external data, such as profiler results, bundle metrics, and third-party library metadata. However, the risk is addressed through explicit security notes advising the user and agent to treat commands as local operations and to verify all third-party dependencies.
Ingestion points: Performance metrics from agent-device, bundle analysis reports from source-map-explorer, and native build logs from gradlew and xcodebuild (referenced in references/bundle-analyze-app.md and references/js-profile-react.md).
Boundary markers: The instructions use natural language and structured optimization workflows (Measure → Optimize → Re-measure → Validate) to maintain context and ensure metrics are verified.
Capability inventory: Extensive capabilities including shell command execution (npx, gradlew, xcodebuild), file system modifications for build configuration, and network operations for bundle analysis tools (referenced across all references/ files).
Sanitization: The skill relies on standard tool outputs and does not include custom sanitization logic for ingested data.

react-native-best-practices