gh-actions-expo-apk-build

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the workflow reads the repository’s committed google-services.json and then runs npx expo prebuild which regenerates and compiles the Android project, causing the LLM to indirectly ingest/act on free text that an outsider can supply via the repo (e.g., submitted files/committed config that will be read and built during the CI run).