The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill repeatedly instructs users to run npx testflight (found in SKILL.md and references/testflight.md). This command downloads and executes an unverified package from the npm registry that is not an official tool from Expo or Apple, posing a high risk of arbitrary code execution.
[COMMAND_EXECUTION]: The skill relies on the execution of shell commands and JavaScript configuration files (store.config.js) which are processed by the EAS CLI. This execution environment provides the capability to perform arbitrary system operations during the build and deployment phases.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external software like eas-cli and refers to the dynamic fetching of metadata from an external API (https://api.example.com/app-store-copy) within the store.config.js script.
[DATA_EXFILTRATION]: The use of the fetch() API within a build-time script like store.config.js creates a potential channel for exfiltrating sensitive environment data or build metadata to remote servers controlled by third parties.
[CREDENTIALS_UNSAFE]: The documentation references the handling of sensitive credentials, including Apple .p8 API keys and Google Service Account JSON files. It provides examples of hardcoded local file paths (e.g., ./AuthKey_XXXXX.p8 and ./google-service-account.json) which increases the risk of these credentials being accidentally included in version control.

expo-deployment