expo-build-debug-apk-gh
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill defines several shell-based procedures for project auditing and environment verification. It uses tools like
grepto inspect configuration files,npx expofor local pre-build checks, andgitfor branch management. These commands are restricted to local file inspection and standard version control operations. - [CREDENTIALS_SAFE]: The instructions include a dedicated section on secret management. It correctly advises that
EXPO_PUBLIC_*environment variables are public by design (embedded in the JS bundle) and explicitly warns against the injection of sensitive server-side secrets like database passwords or service role keys, which could be exposed via APK decompilation. - [EXTERNAL_DOWNLOADS]: The skill utilizes
curlto interact with official GitHub API endpoints (api.github.com) to monitor build runs and download generated APK artifacts. These network operations are directed at well-known, trusted infrastructure for the purpose of retrieving the user's own build outputs.
Audit Metadata