react-native-brownfield-migration
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to inspect local project files, such as
package.jsonandapp.json, to classify the environment and select a migration path (Expo vs. Bare). This creates an ingestion surface where maliciously crafted configuration files could theoretically attempt to influence the agent's logic. - Ingestion points: Project configuration files including
package.jsonandapp.json(SKILL.md, references/quick-start.md). - Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the agent when reading these files.
- Capability inventory: The skill possesses significant capabilities, including package installation (
npm install), command execution vianpx, and native build tool integration (pod install, Gradle) (references/bare-quick-start.md, references/bare-android-aar-generation.md). - Sanitization: No explicit sanitization or strict schema validation is prescribed for the data ingested from these project files before the agent processes it.
- [EXTERNAL_DOWNLOADS]: The skill involves fetching and installing external software packages and CLI tools.
- Instructions include installing the
@callstack/react-native-brownfieldlibrary and usingnpx create-expo-app(references/quick-start.md, references/expo-create-app.md). - The skill references a tool named
agent-devicefor runtime verification and provides instructions to install it via approved paths if it is not present in the environment (SKILL.md, references/expo-ios-integration.md). - These resources are associated with the skill's vendor or recognized as well-known service providers in the mobile development ecosystem.
- [COMMAND_EXECUTION]: The skill provides instructions for executing shell commands to package and integrate React Native modules.
- This includes building artifacts via
npx brownfield package:iosandnpx brownfield package:android, as well as publishing to local Maven repositories (references/bare-ios-xcframework-generation.md, references/bare-android-aar-generation.md).
Audit Metadata