The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file references/new-architecture.md instructs the user to run bunx xcobra expo eval "_IS_FABRIC". The bunx command downloads and executes the xcobra package from the npm registry at runtime. Running unverified third-party CLI tools, especially those that execute arbitrary code via evaluation, poses a risk of remote code execution if the package is malicious or the registry is compromised.
[COMMAND_EXECUTION]: The skill utilizes several powerful shell commands for project maintenance, including rm -rf node_modules .expo, watchman watch-del-all, and npx expo prebuild --clean. While these are common in React Native development, they give the agent broad authority over the local filesystem and environment which could be abused if the context is manipulated.
[PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection (Category 8). It is designed to read and modify sensitive project files like package.json, app.json, and various configuration files. Malicious content within these files could potentially influence the agent's behavior during the upgrade process.
Ingestion points: The agent reads package.json, app.json, babel.config.js, metro.config.js, postcss.config.js, and the patches/ directory (specified in SKILL.md).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore embedded commands or instructions within the files being processed.
Capability inventory: The skill executes npx expo install, rm -rf, pod install, gradlew clean, and bunx xcobra (found across SKILL.md and references/new-architecture.md).
Sanitization: No validation or sanitization of the project file content is mentioned before it is used to determine which packages to remove or which commands to run.

upgrading-expo