eas-simulator
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes official build and development tools including
npx eas-cli,xcodebuild,pod install, andexpo-cli. These are standard tools for mobile application development within the Expo ecosystem. - [EXTERNAL_DOWNLOADS]: The skill downloads and executes official vendor packages using
npx(e.g.,eas-cli@latest,agent-device@latest,submit-expo-feedback@latest). It also facilitates downloading app artifacts fromexpo.devdomains. All identified external resources are owned and maintained by the trusted vendor, Expo. - [CREDENTIALS_SAFE]: The skill provides secure guidance for managing access tokens. It instructs users to set
EXPO_TOKENas an environment variable and explicitly warns that the.env.eas-simulatorfile contains session tokens and must be added to.gitignoreto prevent accidental exposure. - [INDIRECT_PROMPT_INJECTION]: While the skill involves reading UI states from simulators using
agent-device snapshot, which could potentially ingest untrusted data from an application's interface, the risk is inherent to the functional purpose of a UI automation tool and is managed by the agent's internal reasoning guardrails.
Audit Metadata