The Agent Skills Directory

External Configuration Fetching: The skill fetches version metadata for the mobile-app plugin from Microsoft's official GitHub repository to ensure the tool is up to date before proceeding.
Dependency Management and Installation: It automates the update process for npm packages, specifically targeting Microsoft-scoped and project-related dependencies. Security is addressed by using the --ignore-scripts flag during npm install, which prevents the execution of arbitrary scripts that might be bundled with third-party packages.
Command Execution: The skill uses shell commands to interact with the local development environment, including running npm, npx expo, and a local validation script (validate-mobile-files.js). These operations are limited to project maintenance tasks.
Indirect Prompt Injection Surface: The skill processes external data from project files such as package.json and the output of npm outdated. While this represents an ingestion surface for untrusted data, the risk is mitigated by a mandatory human-in-the-loop step, requiring the user to explicitly approve each individual package update via the AskUserQuestion tool.

check-updates