skills/expo/skills/expo-ui/Gen Agent Trust Hub

expo-ui

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches and executes the submit-expo-feedback utility from the npm registry when the user provides feedback. This is a standard vendor-provided tool for the Expo ecosystem.
  • [COMMAND_EXECUTION]: Uses a local Node.js helper script (scripts/list-components.js) to scan the project's node_modules folder and extract available components and modifiers from TypeScript definition files.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external library files (index.d.ts) to inform the agent about available components.
  • Ingestion points: Project node_modules/@expo/ui directory via the list-components.js script.
  • Boundary markers: The script output is intended as raw component lists; no explicit delimiters are defined in the skill instructions.
  • Capability inventory: The skill uses a restricted Bash tool to run the provided Node.js script; the script only performs file read operations.
  • Sanitization: The script employs regex-based filtering to extract specific export patterns, effectively ignoring arbitrary text within the source files.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 04:30 AM
Security Audit — agent-trust-hub — expo-ui