expo-app-clip
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
bunx,npx, andeasto execute various development tools, includingsetup-safariandtestflight. It also uses shell commands likemkdirandtouchto set up directory structures for the Apple App Site Association (AASA) files. - [REMOTE_CODE_EXECUTION]: Includes a feedback mechanism that runs
npx --yes submit-expo-feedback@latest. This pattern downloads and executes the latest version of a script from the npm registry. Within the context of this vendor-authored skill, this is used as a standard support and feedback channel. - [EXTERNAL_DOWNLOADS]: References and fetches resources from
expo.dev,expo.app, andgithub.com. It also directs users to technical documentation hosted onsosumi.ai, which is a common resource for Apple-related technical specifications in the Expo ecosystem. - [DATA_EXFILTRATION]: Contains a feedback loop that transmits user-provided or agent-generated feedback to the vendor's ingestion service. This is a functional requirement for the skill's maintenance and is restricted to the specified feedback CLI.
Audit Metadata