mobile-capacitor-platform — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mobile-capacitor-platform (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The native-runtime and shipping layer for Capacitor apps. enhance-capacitor-ui handles cross-surface layout architecture; this skill handles platform features, native builds, store submission, and migrations.>
Distilled from cap-go/capgo-skills (48 skills, MIT). For deep per-task playbooks, install the full pack:npx skills add Cap-go/capgo-skillsorclaude plugin marketplace add Cap-go/capgo-skills.
package.json: the Capacitor major (@capacitor/core) drives everything. Match plugin majors to it (Capacitor 8 → plugin v8).capacitor.config.ts for appId, webDir, server.url (live-reload vs bundled), and plugin config.ios/, android/) before suggesting platform-specific steps.| Task | Approach |
|---|---|
| Choose a plugin | Prefer official @capacitor/*; for gaps check Capgo's 80+ plugin catalog. Verify the plugin major matches your Capacitor major and has active maintenance. |
| Deep / universal links | iOS Associated Domains + apple-app-site-association; Android intent filters + assetlinks.json. Handle cold-start vs warm via appUrlOpen listener. Test both install states. |
| Push notifications | @capacitor/push-notifications → FCM (Android) + APNs (iOS). Register token, handle foreground vs background, deep-link from tap. Verify entitlements + GoogleService-Info.plist / google-services.json. |
| Offline-first | Cache + queue writes; reconcile on reconnect. Use a real DB plugin (SQLite / Fast SQL), not localStorage, for structured data. Define the conflict-resolution rule explicitly. |
| Keyboard | @capacitor/keyboard — resize mode, scroll-into-view on focus, accessory bar. The #1 source of "input hidden behind keyboard" bugs. |
| Safe area / notch | Use safe-area insets (env vars / plugin), not hardcoded padding. Account for notch, Dynamic Island, home indicator, Android gesture nav. (Pairs with enhance-capacitor-ui.) |
| Splash screen | Configure via plugin + native assets; hide programmatically after first paint to avoid white flash. |
*.keystore, *.p12, local.properties).npm ci → web build → npx cap sync → native build (xcodebuild / Gradle) → sign → upload (TestFlight / Play internal track).PrivacyInfo.xcprivacy), ATT prompt if tracking, permission usage strings, no private APIs, account-deletion path if there are accounts. Most rejections are preflightable.npx capsec scan --ci) — catches hardcoded secrets, insecure storage, network security, auth weaknesses. Wire into CI to fail on high/critical.| From | To | Notes |
|---|---|---|
| Web app / PWA | Capacitor | npx cap init → add platforms → wire plugins for native bits → store-ready. |
| Cordova / PhoneGap | Capacitor | Map plugins to Capacitor equivalents; many Cordova plugins still work but prefer native Capacitor ones. |
| CocoaPods | Swift Package Manager | iOS dependency migration; check each plugin supports SPM. |
| SQLite plugin | Fast SQL | Performance migration for data-heavy apps. |
npx cap sync run after any native dep change.enhance-capacitor-ui — form-factor / platform / pointer layout architecture.workflow-spec-workflow-spec-tdd — spec + TDD spine for the feature itself.full-stack-ship-discipline — backend deps deployed + verified.enhance-web-* — the underlying web UI the Capacitor shell renders.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.