expo-app-development
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill documents secure development practices for the Expo framework, including the use of platform keychains for credentials and runtime validation of configuration and environment variables.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies and mitigates the attack surface associated with ingesting untrusted data from deep links and route parameters.
- Ingestion points: External data enters the app via deep link parameters (documented in
references/navigation-and-links.md) and route parameters (documented inreferences/route-modules.md). - Boundary markers: The instructions explicitly define these inputs as "untrusted input" and mandate that the agent "validate every value taken from an inbound link".
- Capability inventory: The skill covers capabilities including file system access (
references/data-and-storage.md), secure credential storage, and network operations. - Sanitization: Guidelines require strict validation using schemas (e.g., Zod) to parse and verify data before it reaches application logic.
Audit Metadata