command-scaffold-app
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a helper script
scripts/plan-expo-project.mjsthat generates a list of shell commands for the user. It employs strict input validation using a regex (/^[a-z][a-z0-9-]{0,62}$/) to ensure the project name is sanitized, effectively preventing command injection into the generated output. - [CREDENTIALS_UNSAFE]: The instructions in
SKILL.mdandreferences/01-expo-sdk-54.mdprovide clear guidance to never include secrets, tokens, or credentials in the generated code, project configuration, or chat output. It correctly advises using the owner's secret management path instead. - [EXTERNAL_DOWNLOADS]: The skill references official documentation and well-known Expo packages. These resources are from established, trusted technology providers and do not pose a risk.
- [PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to treat builds, uploads, and publishing as separate, user-authorized steps, ensuring the agent does not perform high-privilege operations autonomously.
Audit Metadata