eas-simulator

SUSPICIOUS: the skill’s purpose and capabilities mostly align with remote simulator automation, and most network destinations are official Expo endpoints. However, it materially expands trust by running unpinned npm CLIs and forwarding session credentials/tokens to a third-party controller (`agent-device`), plus exposing local dev assets through tunnels; this is proportionate to the workflow but still medium risk.