The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation suggests that if the agent-device CLI tool is missing, the agent should provide the command npm install -g agent-device@latest to the user. This recommends an unversioned package from the public NPM registry that is not associated with the primary trusted vendor list or the author's identified vendor resource patterns.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data generated by the application under test, which creates a potential surface for indirect prompt injection attacks where malicious application output could influence the agent's logic.
Ingestion points: The agent is instructed in SKILL.md to collect and inspect "app-log collection", "network output", and snapshots of the "React tree, props, hooks" from the running Expo application.
Boundary markers: There are no instructions providing clear delimiters or specific warnings to ignore natural language instructions that might be embedded within the logs or UI metadata.
Capability inventory: The skill allows the agent to execute shell commands via agent-device and npx expo for app building, reloading, and interaction (documented in SKILL.md).
Sanitization: The instructions do not specify any validation, escaping, or filtering of the captured application data before it is analyzed by the agent.
[COMMAND_EXECUTION]: The skill relies on executing shell commands to interact with the development environment and mobile devices/emulators. While these are functional requirements (e.g., agent-device metro reload, npx expo run:ios), they represent a broad execution capability on the host system that is triggered based on the analysis of the aforementioned untrusted inputs.

expo-dev-loop