expo-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions emphasize the protection of sensitive information, such as server credentials and private keys, by explicitly forbidding their placement in client-visible locations like source code or logs.
- [SAFE]: The skill incorporates a robust verification process, directing the agent to validate all proposed changes against official framework documentation and installed project evidence before execution.
- [SAFE]: External references are limited to trusted official documentation sites for Expo and React Native, following the trusted vendor guidelines.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data (e.g., configuration files and source code) to inform its recommendations. Ingestion points: project files like package.json, app config, and route entries (SKILL.md). Boundary markers: The skill includes specific validation steps to verify project mode and SDK before action. Capability inventory: The skill uses capability-based inspect, read, search, and edit tools. Sanitization: Instructions mandate runtime validation of external inputs at the boundary within the generated code architecture.
Audit Metadata