skills/expo/skills/expo-animation/Gen Agent Trust Hub

expo-animation

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing established React Native and Expo ecosystem packages such as react-native-reanimated, react-native-gesture-handler, and expo-router using the standard npx expo install command.\n- [REMOTE_CODE_EXECUTION]: The skill includes a procedure for reporting feedback to the vendor using npx --yes submit-expo-feedback@latest. This command downloads and executes a utility from the NPM registry at runtime.\n- [COMMAND_EXECUTION]: Shell commands are provided for package management and telemetry, specifically using the npx runner to ensure version compatibility with the Expo SDK.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function of generating code based on user-provided animation descriptions creates an inherent attack surface for indirect prompt injection.\n
  • Ingestion points: User requests and animation descriptions are processed to generate implementation code.\n
  • Boundary markers: No explicit delimiters or safety instructions are defined for handling untrusted input.\n
  • Capability inventory: The skill has the ability to execute shell commands (via npx) and generate/write code files.\n
  • Sanitization: There is no evidence of sanitization or filtering applied to user-provided descriptions before they are used in code generation logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 08:36 PM