The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check-sdk-trigger.mjs executes shell commands using spawnSync to interact with npm and tar. This is used to query package metadata (npm view) and extract specific configuration files (bundledNativeModules.json) from downloaded package tarballs (npm pack).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content, including code and manifests, creating a surface for indirect prompt injection.
Ingestion points: Analyzes package.json, package-lock.json, eas.json, application source files (.ts, .js, etc.), and user-provided SDK contracts in contracts/expo-sdk-lines.json.
Boundary markers: Absent; the scanning logic processes raw file content.
Capability inventory: Includes file system read/write/delete (via scripts/check-lib.mjs) and command execution for npm/tar tools (via scripts/check-sdk-trigger.mjs).
Sanitization: Implements maskComments to strip comments from source code before scanning to reduce false positives and potential injection surface in comments.
[EXTERNAL_DOWNLOADS]: The scripts/check-sdk-trigger.mjs script performs network operations via the npm CLI to fetch package information and download tarballs from the official npm registry. These operations are restricted to verifying package versions and configurations required for the SDK upgrade process.

expo-sdk-upgrade