The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various CLI tools using npx and bunx for project upgrades, diagnostics, and code transformation.
[EXTERNAL_DOWNLOADS]: Uses bunx to download and execute the xcobra package from a public registry for verifying the New Architecture status.
[INDIRECT_PROMPT_INJECTION]: The skill processes and modifies local project files, creating an attack surface where malicious content in those files could influence the agent. 1. Ingestion points: Processes project source code (via codemod), package.json, app.json, babel.config.js, metro.config.js, and files in the patches/ directory. 2. Boundary markers: Absent. The instructions do not define delimiters or warnings to ignore instructions embedded in the processed files. 3. Capability inventory: The skill can execute shell commands, modify local files, and perform network requests for package updates. 4. Sanitization: Absent. There is no evidence of content sanitization or validation for the data ingested from the project environment.

upgrading-expo