The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill repeatedly recommends the use of npx testflight as a shortcut for iOS builds and submissions in SKILL.md, references/ios-app-store.md, and references/testflight.md. This package is not an official tool in the Expo ecosystem and the legacy testflight package on public registries is unrelated to modern workflows, posing a risk of arbitrary code execution.
[EXTERNAL_DOWNLOADS]: In references/app-store-metadata.md, the skill provides a store.config.js example that uses fetch() to download data from https://api.example.com/app-store-copy. Fetching executable configuration logic from untrusted external domains at runtime is a significant security risk.
[CREDENTIALS_UNSAFE]: The documentation includes hardcoded placeholder credentials for app reviewers in the store.config.json example (found in references/app-store-metadata.md), including a demo username and password.
[COMMAND_EXECUTION]: The skill facilitates extensive shell command execution using the eas-cli and npx with access to the project root and sensitive deployment files.
[DATA_EXFILTRATION]: The skill provides instructions for handling sensitive deployment secrets, such as google-service-account.json and Apple .p8 API keys. The demonstration of network-enabled configuration scripts (store.config.js) that operate in the same environment as these secrets creates a potential exfiltration path.

expo-deployment