expo-architecture
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill does not contain any instructions that attempt to bypass AI safety guidelines or override system prompts. It uses standard instructional language to guide the agent's behavior within the context of architectural review.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets were found. The skill explicitly prohibits storing secrets in insecure locations such as source code, logs, or client-visible environment variables (EXPO_PUBLIC_*). It recommends using expo-secure-store for sensitive values.
- [DATA_EXFILTRATION]: There are no patterns suggesting the exfiltration of sensitive data. The instructions focus on local project analysis and advise against logging sensitive payloads or tokens.
- [COMMAND_EXECUTION]: The skill identifies potentially dangerous operations (e.g., prebuild --clean, EAS publication, package installation) and defines them as 'gated side effects' that must not be executed without explicit user authorization.
- [EXTERNAL_DOWNLOADS]: References are made to official and trusted documentation from Expo and React Native. No unverified or malicious remote code execution patterns were detected.
Audit Metadata