The Agent Skills Directory

[SAFE]: The skill serves as a documentation and guidance resource for mobile development. It includes a utility script, scripts/mobile_audit.py, which is a static analysis tool designed to audit local source code for compliance with mobile best practices.
[INDIRECT_PROMPT_INJECTION]: The skill has a potential surface for indirect prompt injection because the mobile_audit.py script reads local source code files into the agent's context for analysis. However, the risk is negligible as the skill lacks network or file-write capabilities in its platform configuration (allowed-tools), preventing any malicious instructions from being exfiltrated or persisting.
Ingestion: The script reads file contents using standard Python file operations.
Boundaries: Content is processed for regex matching.
Capabilities: The skill is restricted to reading and searching (Read, Glob, Grep, Bash).
Sanitization: Content is handled as data for static analysis rather than executed or interpreted as instructions.
[CREDENTIALS_UNSAFE]: The skill proactively recommends against unsafe credential storage, specifically instructing users to avoid AsyncStorage for sensitive tokens and instead use SecureStore or Keychain.

mobile-design