The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes module.registerHooks in scripts/lib/app-modules.mjs to implement a custom TypeScript and JSON loader for Node.js. This mechanism allows the skill's auditing scripts to dynamically resolve, load, and execute modules directly from the audited project's repository. Additionally, scripts/check-lib.mjs includes an importPackage function that dynamically imports Node.js packages from computed filesystem paths.
[INDIRECT_PROMPT_INJECTION]: The auditing framework (check-icons.mjs and check-app-art.mjs) ingests and executes the audited project's source code to perform its checks. This creates an attack surface where a compromised or malicious project could execute arbitrary code within the checker's process, which possesses broad filesystem permissions via the check-lib.mjs helper library.
Ingestion points: Project source files are walked and loaded via scripts/lib/app-modules.mjs.
Boundary markers: No isolation or sandboxing is applied to the project code during the import and execution process.
Capability inventory: The auditing process has access to extensive filesystem utilities (read, write, delete, copy) provided by the check-lib.mjs library.
Sanitization: External code from the project is executed as ES modules without sanitization or safety checks.
[EXTERNAL_DOWNLOADS]: The skill manages dependencies on well-known mobile development libraries including @shopify/react-native-skia, expo, and expo-splash-screen. These downloads originate from established package registries and official repositories.

icons-app-icon-and-splash