expo-skill-feedback
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and run the
submit-expo-feedbackpackage from npm using the commandnpx --yes submit-expo-feedback@latest. - [REMOTE_CODE_EXECUTION]: Execution of the remote
submit-expo-feedbackpackage vianpxis used to submit user-approved feedback and failure reports (eval candidates) to Expo's backend. - [DATA_EXFILTRATION]: The skill includes a telemetry system that sends anonymous usage data, such as OS name, architecture, a hashed installation ID, and the name of the invoked skill, to PostHog (
us.i.posthog.com). This telemetry is explicitly off by default and requires user opt-in via a provided script or environment variables. - [COMMAND_EXECUTION]: The telemetry script
scripts/skill-event.cjsuseschild_process.spawnto launch a detached background process to handle network requests without blocking the agent's interaction flow. - [CREDENTIALS_UNSAFE]: The telemetry configuration in
scripts/telemetry_common.cjsincludes a hardcoded PostHog project API key. This is documented as a public, write-only ingestion key intended for client-side data submission.
Audit Metadata