The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends the use of npx rn-new --nativewind for project initialization in references/expo-setup.md. This command downloads and executes a script from a third-party npm package (rn-new) which is not authored by a trusted organization or well-known service.
[INDIRECT_PROMPT_INJECTION]: The audit prompt provided in SKILL.md instructs the agent to read and analyze various project files which could contain untrusted data from external sources.
Ingestion points: Project configuration files including tailwind.config.js, global.css, babel.config.js, and metro.config.js as specified in the audit instructions.
Boundary markers: The instructions do not define boundary markers to encapsulate file content or warn the agent to ignore instructions embedded within the analyzed data.
Capability inventory: The skill context assumes the agent can propose file modifications (diffs) and encourages the execution of development tools like npx expo start --clear (found in references/troubleshooting.md).
Sanitization: There is no mechanism described for sanitizing or validating the content extracted from repository files before it is processed by the agent.

styling-nativewind-v4-expo