The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The reference file references/navigation-patterns.md contains code examples for authentication flows that store sensitive tokens using @react-native-async-storage/async-storage. This practice is identified as a vulnerability within the skill's own anti-pattern list in SKILL.md, which correctly points out that local storage of tokens is vulnerable to extraction. Storing credentials in plain text via AsyncStorage poses a risk to developers who follow the documentation without implementing secure alternatives like expo-secure-store.
[INDIRECT_PROMPT_INJECTION]: The skill outlines "AI-Assisted UI Generation" capabilities in references/compose-multiplatform-2026.md, which creates an attack surface for indirect prompt injection.
Ingestion points: Text descriptions provided by users or external sources to generate UI code (references/compose-multiplatform-2026.md).
Boundary markers: The skill does not define delimiters or specific instructions to ignore embedded commands within the untrusted input.
Capability inventory: The skill facilitates complex code and UI generation based on natural language input.
Sanitization: There is no documentation or evidence of input validation or escaping for the processed text descriptions.
[EXTERNAL_DOWNLOADS]: The skill mentions several standard mobile development libraries through npm install instructions in references/navigation-patterns.md and references/reanimated-patterns.md. These include industry-standard packages such as @react-navigation/native, react-native-reanimated, and react-native-gesture-handler. These are well-known services within the React Native ecosystem.

mobile-pro