entrig-expo
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the @entrig/react-native package. This is a vendor-owned resource corresponding to the skill author entrig and is considered a standard part of the integration process.
- [COMMAND_EXECUTION]: The skill uses standard Expo development commands such as npx expo prebuild and npm install. These are used to configure the native project environment as described in the skill's purpose.
- [SAFE]: The skill correctly advises against hardcoding API keys, recommending the use of Expo's environment variable system (EXPO_PUBLIC_*) and .env files to prevent accidental credential leakage.
- [SAFE]: The skill reads local project configuration files to determine project state (Ingestion points: app.json, App.tsx, package.json). While this represents an ingestion point for potentially untrusted data, the skill uses this information solely for standard configuration steps and includes human-review checkpoints for impactful actions like project regeneration (Capability inventory: npm install, npx expo prebuild; Boundary markers: None; Sanitization: None).
Audit Metadata