The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references an external GitHub repository (https://github.com/tiajinsha/JKVideo.git) and binary releases (APK) from an unverified source that is not a recognized trusted vendor or the skill author (ara.so).\n- [COMMAND_EXECUTION]: Installation instructions include running git clone, npm install, and npx expo start, which execute code retrieved from the unverified external repository.\n- [REMOTE_CODE_EXECUTION]: The combination of downloading external source code and immediately executing it through package managers and development tools constitutes a remote code execution risk from unverified sources.\n- [INDIRECT_PROMPT_INJECTION]: The skill implements logic to consume and parse data from external APIs (Bilibili REST and WebSocket), including danmaku and video metadata. \n
Ingestion points: api.get and WebSocket connections to Bilibili domains in useDanmaku.ts and useLiveDanmaku.ts.\n
Boundary markers: None present for separating external content from agent context.\n
Capability inventory: FileSystem.writeAsStringAsync in buildDashMpd.ts, WebView injection in VideoPlayer.tsx, and FileSystem.createDownloadResumable in downloadStore.ts.\n
Sanitization: Implements escapeXml for the DASH manifest generator in utils/buildDashMpd.ts.\n- [CREDENTIALS_UNSAFE]: The code specifically handles the extraction and storage of the SESSDATA cookie (a sensitive Bilibili session credential) using @react-native-async-storage/async-storage and transmits it to https://api.bilibili.com via an axios interceptor.

jkvideo-bilibili-react-native