The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses node:child_process.spawnSync and spawnSync to execute npm and npx commands for auditing and installing dependencies.
Logic in scripts/plan-dependency.mjs and templates/scripts/deps/check-deps.ts runs commands such as npm view, npm config get, npx expo install, and npx expo-doctor.
Inputs from the repository's package.json and package-lock.json are passed as arguments to these subprocesses. The implementation uses argument arrays with spawnSync, which effectively mitigates common command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to retrieve necessary package and platform metadata.
It queries the official npm registry (registry.npmjs.org) and Expo's versioning API (api.expo.dev) to verify package publish times, licensing information, and alignment with the Expo SDK.
These operations are directed at well-known, established technology services and are essential for the skill's stated purpose of auditing dependency security.

dependency-management