react-native-expo
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a shell script (
scripts/check-rn-version.sh) designed to verify the React Native version and dependencies in a local project. The script usesnodeto programmatically accesspackage.jsondata, which is a standard diagnostic practice.\n- [COMMAND_EXECUTION]: A companion agent (expo-build) is included to automate the build and submission process. It utilizes theBashtool to run official CLI commands such asnpx expoandnpx eas-cli. These operations are well-documented and essential for Expo development.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official React Native and Expo packages using standard package managers. All external references point to trusted organizations (Meta, Expo) and official documentation sites.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface via theexpo-buildagent.\n - Ingestion points: Project configuration files
app.jsonandeas.json(agents/expo-build.md).\n - Boundary markers: None explicitly defined in the file reading phase.\n
- Capability inventory: All subprocess calls including
npx eas-cli build,npx eas-cli submit, andnpm testare executed via theBashtool (agents/expo-build.md).\n - Sanitization: The agent is instructed to request user confirmation before performing sensitive operations like production deployments or version bumps.\n- [SAFE]: The skill adheres to security best practices, such as explicitly instructing the build agent not to share production signing credentials in logs.
Audit Metadata