The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The check-auth.mjs script performs static analysis by ingesting and reading arbitrary source code files within the user's project directory. This represents a potential surface for indirect prompt injection if malicious code is crafted specifically to trigger or mislead the analyzer's output, which is then interpreted by an AI agent. However, the script employs lexical masking of comments and strings before scanning, which provides a layer of isolation for the processed data.
[COMMAND_EXECUTION]: The scripts/check-lib.mjs library includes a runNode function that utilizes spawnSync to execute local Node.js scripts. This functionality is used by the skill's self-test runner (selftest.mjs) to validate the security checker against a suite of intentional 'bad' fixtures. The execution is restricted to script paths resolved locally within the skill's directory structure.
[SAFE]: The skill's primary focus is enhancing the security posture of mobile applications by enforcing strict rules for token storage in hardware-backed secure elements and providing secure logic for PKCE-based OAuth and Apple Sign-in flows.

auth-and-secure-storage