react-native-brownfield-migration

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to inspect local project files, such as package.json and app.json, to classify the environment and select a migration path (Expo vs. Bare). This creates an ingestion surface where maliciously crafted configuration files could theoretically attempt to influence the agent's logic.
  • Ingestion points: Project configuration files including package.json and app.json (SKILL.md, references/quick-start.md).
  • Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the agent when reading these files.
  • Capability inventory: The skill possesses significant capabilities, including package installation (npm install), command execution via npx, and native build tool integration (pod install, Gradle) (references/bare-quick-start.md, references/bare-android-aar-generation.md).
  • Sanitization: No explicit sanitization or strict schema validation is prescribed for the data ingested from these project files before the agent processes it.
  • [EXTERNAL_DOWNLOADS]: The skill involves fetching and installing external software packages and CLI tools.
  • Instructions include installing the @callstack/react-native-brownfield library and using npx create-expo-app (references/quick-start.md, references/expo-create-app.md).
  • The skill references a tool named agent-device for runtime verification and provides instructions to install it via approved paths if it is not present in the environment (SKILL.md, references/expo-ios-integration.md).
  • These resources are associated with the skill's vendor or recognized as well-known service providers in the mobile development ecosystem.
  • [COMMAND_EXECUTION]: The skill provides instructions for executing shell commands to package and integrate React Native modules.
  • This includes building artifacts via npx brownfield package:ios and npx brownfield package:android, as well as publishing to local Maven repositories (references/bare-ios-xcframework-generation.md, references/bare-android-aar-generation.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 05:35 AM