expo-gluestack-setup
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses official package managers (npx and bunx) to download and execute the
gluestack-uiCLI tool. It also references official documentation fromgluestack.ioand source code fromgithub.com/gluestack, which are established and well-known repositories in the mobile development ecosystem.\n- [COMMAND_EXECUTION]: The skill runs diagnostic commands such asgluestack-ui init --helpto confirm environment capabilities. It further generates precise shell commands for the user to execute manually in their terminal, maintaining a 'human-in-the-loop' security model for project modifications.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes local project files to determine the current state of the application and apply necessary configuration updates.\n - Ingestion points: Project files including
package.json,tailwind.config.js,metro.config.js, andglobal.cssare inspected to verify prerequisites and setup status.\n - Boundary markers: The skill follows a strict
Gluestack Handoffformat and outcome tracking to ensure the agent maintains clear boundaries between its analysis and project modification steps.\n - Capability inventory: The skill possesses the ability to read and update project configuration files and execute non-interactive CLI help commands.\n
- Sanitization: Verification criteria are established to validate that generated provider and component exports resolve correctly and that configuration rewrites remain consistent with official framework requirements.
Audit Metadata