The Agent Skills Directory

[DYNAMIC_EXECUTION]: The helper library scripts/check-lib.mjs contains logic to dynamically import Node.js packages using computed paths via the import() function. This is specifically used to load internal tooling dependencies (such as pngjs) from a configurable tooling directory. This behavior is documented and intended for managing the audit tool's own environment.
[INDIRECT_PROMPT_INJECTION]: The skill functions as a static analyzer that ingests and processes various project files, including configuration files, lockfiles, and source code.
Ingestion points: scripts/audit-repo.mjs, scripts/audit-bundle.mjs, scripts/audit-privacy-manifest.mjs, and scripts/audit-app-bundle.mjs read project metadata and source code.
Boundary markers: The scripts perform regex-based scanning and structured parsing (e.g., JSON, Plist) without specific delimiters to ignore embedded instructions in the audited data.
Capability inventory: The auditing scripts perform file system reads, use execFileSync to run standard project commands (e.g., npx expo), and generate reports.
Sanitization: As a static analysis tool, it does not sanitize the content of the files it scans, as its purpose is to report the content's properties.
[SAFE_PATTERNS]: The skill includes a 'network guard' template (templates/src/services/test-hooks/network-guard.ts) that intentionally intercepts network calls (fetch, XMLHttpRequest, WebSocket) to block and log unauthorized traffic during automated tests. This is a security-enhancing feature for the development lifecycle.

privacy-and-store-declarations