expo-dev-client-v55
Fail
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute
npx --yes submit-expo-feedback@latest. This command downloads and executes a package from the npm registry at runtime without version pinning. The packagesubmit-expo-feedbackdoes not originate from a verified organization or the author's identified namespace. - [INDIRECT_PROMPT_INJECTION]: The feedback instruction in
SKILL.mdinterpolates user-supplied text into a shell command:npx --yes submit-expo-feedback@latest --category skills --subject "expo-dev-client" "<actionable feedback>". Ingestion points: User-provided feedback string inSKILL.md. Boundary markers: None; the command uses standard shell quoting which can be bypassed by an attacker if the agent does not properly escape the input. Capability inventory: Access to shell execution for powerful tools likenpx,eas,tar,adb, andxcrun. Sanitization: No sanitization or validation steps are defined for the user input. - [COMMAND_EXECUTION]: The skill uses various powerful CLI tools (
eas,xcrun,adb,ideviceinstaller) to manage native builds and device installations, providing a significant capability surface for potential abuse if combined with unverified input. - [EXTERNAL_DOWNLOADS]: The skill fetches resources from external sources, specifically downloading the
submit-expo-feedbackpackage from the npm registry during the feedback process.
Recommendations
- AI detected serious security threats
Audit Metadata