expo-ui
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the
submit-expo-feedbackutility from the npm registry when the user provides feedback. This is a standard vendor-provided tool for the Expo ecosystem. - [COMMAND_EXECUTION]: Uses a local Node.js helper script (
scripts/list-components.js) to scan the project'snode_modulesfolder and extract available components and modifiers from TypeScript definition files. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external library files (
index.d.ts) to inform the agent about available components. - Ingestion points: Project
node_modules/@expo/uidirectory via thelist-components.jsscript. - Boundary markers: The script output is intended as raw component lists; no explicit delimiters are defined in the skill instructions.
- Capability inventory: The skill uses a restricted
Bashtool to run the provided Node.js script; the script only performs file read operations. - Sanitization: The script employs regex-based filtering to extract specific export patterns, effectively ignoring arbitrary text within the source files.
Audit Metadata