limrun-expo-development
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external project configuration files (like
app.jsonandpackage.json) to extract metadata such asBUNDLE_ID,PACKAGE, andSCHEME. These values are interpolated directly into shell commands for managing remote assets and device instances.\n - Ingestion points:
npx expo config --type introspect --jsonreads from local project files.\n - Boundary markers: No delimiters or safety instructions are used when interpolating these values into prompts or shell commands.\n
- Capability inventory: The skill performs shell command execution, file system operations (via
npm), and network tunneling.\n - Sanitization: The skill does not validate or escape the values extracted from the project configuration before using them in shell commands, potentially allowing for command injection if a project file contains malicious payloads.\n- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands that interpolate variables derived from the local environment and project state.\n
- Evidence: Commands like
lim asset list --name-prefix "$BUNDLE_ID/",lim android launch-app "$PACKAGE", andlim ios open-url --id <ios-instance-id> "$DEV_CLIENT_URL"demonstrate the reliance on potentially untrusted variable data for execution parameters.
Audit Metadata