react-native-brownfield-migration

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install standard developer dependencies from public registries, specifically the @callstack/react-native-brownfield package via NPM and the xcodeproj gem via RubyGems. These originate from well-known maintainers in the mobile development community.- [COMMAND_EXECUTION]: The skill facilitates the execution of common mobile development build tools and CLI utilities, including npm, npx, pod install, gradlew, and xcodebuild. These commands are used as intended for dependency management and artifact generation within the local environment.- [DYNAMIC_EXECUTION]: The skill utilizes codegen utilities to generate native platform bindings and provides a Ruby script that uses the xcodeproj gem to automate the modification of Xcode project files. These are documented as standard procedures for integrating React Native into native host applications.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project metadata to determine the migration strategy. \n- Ingestion points: package.json, app.json, settings.gradle, Podfile, and brownfield.config.* files within the target project directory. \n- Boundary markers: None explicitly defined for file parsing. \n- Capability inventory: The agent has the ability to execute shell commands, perform file system writes, and run Ruby scripts. \n- Sanitization: No explicit sanitization or validation of the ingested configuration data is mentioned beyond basic project classification logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 02:42 PM