Skills
Navigate
skills/expo/skills/expo-native-ui/Gen Agent Trust Hub

expo-native-ui

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides a command to submit feedback using npx --yes submit-expo-feedback@latest. This command downloads and executes a package from the npm registry at runtime.
  • [COMMAND_EXECUTION]: The documentation includes shell commands for feedback submission and installing development dependencies via npm (e.g., react-native-wgpu, three).
  • [INDIRECT_PROMPT_INJECTION]: The feedback mechanism in SKILL.md defines a surface where user-generated feedback is interpolated into a shell command for execution.
  • Ingestion points: User-supplied <actionable feedback> string in the feedback command in SKILL.md.
  • Boundary markers: Absent.
  • Capability inventory: Shell execution via npx in SKILL.md and file system writes via expo-file-system in references/media.md.
  • Sanitization: None mentioned in the instructions for the feedback command.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 08:52 PM
Security Audit — agent-trust-hub — expo-native-ui