The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends the global installation of eas-cli, which is the official tool for Expo Application Services. However, it also suggests the use of npx testflight as a shortcut for iOS TestFlight submissions. The testflight package on the public registry is not an official Expo or Apple tool, and its execution via npx could lead to the download and execution of untrusted or malicious code.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to perform deployments and metadata updates based on project-level configuration files (eas.json, store.config.json). In a collaborative environment, these files act as ingestion points for untrusted data that can influence high-privilege deployment actions.
Ingestion points: eas.json, store.config.json, and store.config.js located in the project root.
Boundary markers: None specified in the instructions to prevent the agent from following embedded commands in these files.
Capability inventory: Access to sensitive deployment credentials via EAS, the ability to perform network requests, and the capability to submit binaries to the App Store and Google Play Store.
Sanitization: The instructions do not mention validation or sanitization of the configuration data before it is used in CLI commands.
[DYNAMIC_EXECUTION]: The skill provides examples of using a JavaScript configuration file (store.config.js) to dynamically manage App Store metadata. This file is executed by the EAS CLI during the deployment process and is shown fetching data from remote URLs (api.example.com), which allows for arbitrary code logic to run in the deployment environment.

expo-deployment