gh-actions-expo-apk-build
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides technical documentation and templates for automating Android builds within GitHub Actions CI/CD environments. The instructions are aligned with standard developer workflows for React Native and Expo projects.
- [EXTERNAL_DOWNLOADS]: The skill references downloads from well-known and trusted sources, including Google's Android Maven repository (dl.google.com) for library inspection and the GitHub API for artifact retrieval. These operations are documented neutrally as they target official infrastructure.
- [COMMAND_EXECUTION]: Provides instructions for using standard development tools such as the GitHub CLI (gh), npm, and Gradle. These commands are necessary for the skill's primary purpose of building, monitoring, and retrieving mobile application artifacts.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets were detected. The skill correctly identifies sensitive items such as GH_TOKEN, EXPO_TOKEN, and service-account JSONs, providing clear instructions on using environment variables and .gitignore to prevent accidental exposure.
- [DYNAMIC_EXECUTION]: Includes a custom Expo config plugin (pin-gradle-dependency.js) that programmatically modifies the Gradle build configuration. This is a standard and supported method for managing native dependencies in Expo projects.
Audit Metadata