The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The provided list-components.js script parses JSDoc summaries from TypeScript definition files within the local node_modules/@expo/ui directory and prints them for the agent. This represents an indirect prompt injection surface where a compromised dependency could potentially provide malicious instructions to the agent. Given the legitimate developer discovery use case and the specific targeting of documentation strings, the risk is minimal.
Ingestion points: scripts/list-components.js (reading .d.ts files from node_modules)
Boundary markers: None present in the script's stdout output
Capability inventory: The agent has capabilities for file system access and shell command execution
Sanitization: No sanitization is performed on the extracted JSDoc prose before it is displayed to the agent
[DYNAMIC_EXECUTION]: The skill includes a JavaScript utility (scripts/list-components.js) and instructs the agent to execute it locally using Node.js to gather context about the installed Expo UI version. The script performs read-only operations on local files and uses filename sanitization for the provided project path.
[EXTERNAL_DOWNLOADS]: The skill's installation instructions include downloading the @expo/ui package from the NPM registry via npx expo install. This is a standard operation for the well-known Expo mobile development ecosystem.

expo-ui