expo-animation
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing established React Native and Expo ecosystem packages such as
react-native-reanimated,react-native-gesture-handler, andexpo-routerusing the standardnpx expo installcommand.\n- [REMOTE_CODE_EXECUTION]: The skill includes a procedure for reporting feedback to the vendor usingnpx --yes submit-expo-feedback@latest. This command downloads and executes a utility from the NPM registry at runtime.\n- [COMMAND_EXECUTION]: Shell commands are provided for package management and telemetry, specifically using thenpxrunner to ensure version compatibility with the Expo SDK.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function of generating code based on user-provided animation descriptions creates an inherent attack surface for indirect prompt injection.\n - Ingestion points: User requests and animation descriptions are processed to generate implementation code.\n
- Boundary markers: No explicit delimiters or safety instructions are defined for handling untrusted input.\n
- Capability inventory: The skill has the ability to execute shell commands (via
npx) and generate/write code files.\n - Sanitization: There is no evidence of sanitization or filtering applied to user-provided descriptions before they are used in code generation logic.
Audit Metadata