The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the validation of workflow files using the eas workflow:validate utility.
This utility is executed from the local project's node_modules directory.
The instructions prioritize using the project's pinned dependency version for security.
[EXTERNAL_DOWNLOADS]: The skill retrieves JSON schemas and syntax guides from external Expo-controlled domains.
A custom fetch.js script is used to perform these downloads, which includes a strict whitelist of three approved URLs.
The script implements security best practices including redirect blocking, response size limits, and restricted file system permissions for its cache.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external reference data which could be a vector for indirect injection.
Ingestion points: Data is fetched from api.expo.dev and raw.githubusercontent.com.
Boundary markers: The instructions include a clear directive that fetched text remains source data and does not grant permission to execute instructions.
Capability inventory: The skill possesses file write access for workflow YAMLs and command execution access for the local validator CLI.
Sanitization: The skill recommends reviewing project configuration before execution in untrusted environments.

eas-workflows