expo-app-development
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of instructional markdown files providing architectural guidance. No executable code or scripts were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill mandates defensive practices by requiring that all route parameters and inbound deep links be treated as untrusted data and validated against a schema before processing, mitigating the risk of injection attacks.
- [CREDENTIALS_UNSAFE]: The guidelines provide robust security advice, instructing developers to use the platform keychain (SecureStore) for credentials and prohibiting the use of public environment variables for sensitive build-time secrets.
- [EXTERNAL_DOWNLOADS]: The skill correctly references the official Expo MCP server (https://mcp.expo.dev/mcp) and provides guidelines for secure authentication using environment variables rather than hardcoded tokens, following industry best practices for a well-known service.
Audit Metadata