expo-skill-feedback
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute thesubmit-expo-feedbackpackage from the npm registry, which is the official method for submitting feedback to the vendor. - [COMMAND_EXECUTION]: Local Node.js scripts are used to manage opt-in telemetry state and report skill usage events. These scripts are self-contained and perform legitimate configuration and reporting tasks.
- [DATA_EXFILTRATION]: If enabled, the skill sends anonymous telemetry (skill name, platform info, and a hashed installation ID) to PostHog. This data is non-sensitive and the process is fully transparent and opt-in.
- [CREDENTIALS_UNSAFE]: The code contains a hardcoded PostHog public ingestion key. This is a write-only key designed for client-side event submission and does not pose a security risk to the user or account.
Audit Metadata