upgrading-expo
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and execute packages using 'npx' and 'bunx' from the npm registry. While many tools like 'expo' and 'expo-doctor' are industry standards, the reference to 'xcobra' in the architecture verification section represents an unverifiable dependency from an unknown source.
- [REMOTE_CODE_EXECUTION]: The use of 'bunx xcobra' allows for the download and immediate execution of remote code from the npm registry without version pinning or integrity verification, which is a common vector for supply chain attacks.
- [COMMAND_EXECUTION]: The skill provides various project maintenance commands, including destructive operations like 'rm -rf node_modules .expo' and global system operations like 'watchman watch-del-all'. While standard for clearing Expo caches, these commands perform direct modifications to the local environment.
- [DYNAMIC_EXECUTION]: The architecture verification guide suggests using 'expo eval' to execute arbitrary JavaScript strings within the running application context to inspect internal state variables such as '_IS_FABRIC'.
Audit Metadata