The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs users to run npx testflight for iOS submissions across multiple files. The testflight package on the NPM registry is an unverified, deprecated third-party library not affiliated with Expo or Apple. Running unverified packages via npx allows for the execution of arbitrary remote code.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for automated metadata management that ingests external data. \n
Ingestion points: Processes data from store.config.json and external API fetches in store.config.js (e.g., fetching from api.example.com).\n
Boundary markers: Lacks delimiters or safety instructions to prevent the agent from following commands embedded in the metadata.\n
Capability inventory: Uses eas metadata:push and eas submit to transmit data to external production environments (App Stores).\n
Sanitization: No validation or sanitization is performed on the ingested content before it is pushed to production stores.\n- [COMMAND_EXECUTION]: The EAS Workflow examples use type: run steps to execute shell commands like git diff. This job type provides a mechanism for arbitrary shell execution within the CI/CD environment.\n- [CREDENTIALS_UNSAFE]: Sample configuration files include hardcoded credentials (demoPassword) in the metadata review section. Hardcoding passwords in configuration files is a security risk if these files are committed to version control or shared.\n- [EXTERNAL_DOWNLOADS]: The skill uses npm install -g eas-cli and npx testflight, which download packages from the public NPM registry. While eas-cli is a well-known tool, testflight is an unverified external dependency.

expo-deployment