react-native-brownfield-migration
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install standard developer dependencies from public registries, specifically the
@callstack/react-native-brownfieldpackage via NPM and thexcodeprojgem via RubyGems. These originate from well-known maintainers in the mobile development community.- [COMMAND_EXECUTION]: The skill facilitates the execution of common mobile development build tools and CLI utilities, includingnpm,npx,pod install,gradlew, andxcodebuild. These commands are used as intended for dependency management and artifact generation within the local environment.- [DYNAMIC_EXECUTION]: The skill utilizes codegen utilities to generate native platform bindings and provides a Ruby script that uses thexcodeprojgem to automate the modification of Xcode project files. These are documented as standard procedures for integrating React Native into native host applications.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project metadata to determine the migration strategy. \n- Ingestion points:package.json,app.json,settings.gradle,Podfile, andbrownfield.config.*files within the target project directory. \n- Boundary markers: None explicitly defined for file parsing. \n- Capability inventory: The agent has the ability to execute shell commands, perform file system writes, and run Ruby scripts. \n- Sanitization: No explicit sanitization or validation of the ingested configuration data is mentioned beyond basic project classification logic.
Audit Metadata