The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a Python utility script (scripts/mobile_audit.py) and instructions for the agent to execute it (e.g., python scripts/mobile_audit.py . --json) to analyze the user's project. The script is a local, read-only scanner designed with security controls such as path resolution checks (ensuring analysis remains within the target directory) and resource limits (file count and byte caps).
[INDIRECT_PROMPT_INJECTION]: The audit script represents a minor indirect prompt injection surface as it ingests untrusted project source code to generate report findings. However, the risk is negligible as the script uses static regex pattern matching rather than executing the scanned code, and the skill instructions explicitly state that the helper's output is advisory and should be validated by the user.
Ingestion points: Project source files (paths matching .tsx, .ts, .jsx, .js, .dart, .kt, .swift) read by scripts/mobile_audit.py.
Boundary markers: The script produces structured JSON output, providing clear delimitation for the agent.
Capability inventory: The script is limited to read-only file access within the target directory; it has no network access or file-writing capabilities.
Sanitization: The script performs static pattern matching and does not interpret or execute the content of the files it scans.
[SAFE]: The skill provides expert-level security guidance for mobile development, such as recommending platform-native secure storage (iOS Keychain, Android Keystore) over insecure options like AsyncStorage, and warning against embedding secrets in mobile binaries. The provided Python script follows security best practices for file scanners, including the use of O_NOFOLLOW and O_NONBLOCK flags.

mobile-design