expo-dev-client
Warn
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes a command
npx --yes submit-expo-feedback@latestthat downloads and runs code from the NPM registry. The use of the@latesttag means the skill does not verify the version or integrity of the package at runtime, which could result in the execution of malicious updates if the package is compromised.\n- [COMMAND_EXECUTION]: The feedback commandnpx --yes submit-expo-feedback@latest --category skills --subject "expo-dev-client" "<actionable feedback>"interpolates user-controlled text directly into a shell command string. Without explicit sanitization or escaping, this could allow for arbitrary shell command injection if the input contains shell metacharacters.\n- [EXTERNAL_DOWNLOADS]: The skill references thesubmit-expo-feedbackpackage from the public NPM registry. This package is not an official tool from the primary technology vendor (Expo) and is fetched dynamically.\n- [INDIRECT_PROMPT_INJECTION]: The feedback ingestion point creates a potential for indirect injection attacks.\n - Ingestion points: The
<actionable feedback>parameter within the feedback submission command inSKILL.md.\n - Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are present to delimit user-supplied content.\n
- Capability inventory: The skill possesses the ability to execute shell commands (e.g.,
npx,eas,adb,xcrun,tar).\n - Sanitization: No sanitization or validation of the user-provided string is performed before it is interpolated into the shell command execution path.
Audit Metadata