expo-dev-client
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user/agent to use
eas build, which downloads dependencies from official registries (NPM) and interacts with Expo's cloud infrastructure (expo.dev). These are trusted vendor services. - [COMMAND_EXECUTION]: Provides numerous commands for local development environment setup, including
eas build,npx expo start,adb install, andxcrun simctl. These are standard tools for mobile development. - [INDIRECT_PROMPT_INJECTION]: The
agents/openai.yamlfile contains a meta-instruction that directs the agent to load a different skill (expo-skill-feedback) under specific conditions. This creates a redirection layer that could be used to influence agent behavior through external skill loading triggers.
Audit Metadata