expo-native-ui
Warn
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: In SKILL.md, the documentation instructs the agent or user to run the shell command
npx --yes submit-expo-feedback@latest. This execution occurs outside the controlled environment of the skill's own code. - [EXTERNAL_DOWNLOADS]: The feedback instruction relies on downloading a package named
submit-expo-feedbackfrom the public NPM registry. This package is not associated with a verified trusted organization or the author's documented vendor resources. - [REMOTE_CODE_EXECUTION]: The use of
npxwith the@latesttag to run an external tool constitutes a remote code execution risk, as the content of the downloaded package can change at any time without a versioned audit trail. - [SAFE]: The skill uses standard, well-recognized libraries from the React Native and Expo ecosystems (e.g., Reanimated, Three.js, Expo SQLite, and Expo Blur) to implement its primary features.
- [SAFE]: The storage and media handling implementations follow security best practices, such as using
expo-secure-storefor sensitive data and requesting necessary permissions for hardware access.
Audit Metadata