limrun-expo-development

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external project configuration files (like app.json and package.json) to extract metadata such as BUNDLE_ID, PACKAGE, and SCHEME. These values are interpolated directly into shell commands for managing remote assets and device instances.\n
  • Ingestion points: npx expo config --type introspect --json reads from local project files.\n
  • Boundary markers: No delimiters or safety instructions are used when interpolating these values into prompts or shell commands.\n
  • Capability inventory: The skill performs shell command execution, file system operations (via npm), and network tunneling.\n
  • Sanitization: The skill does not validate or escape the values extracted from the project configuration before using them in shell commands, potentially allowing for command injection if a project file contains malicious payloads.\n- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands that interpolate variables derived from the local environment and project state.\n
  • Evidence: Commands like lim asset list --name-prefix "$BUNDLE_ID/", lim android launch-app "$PACKAGE", and lim ios open-url --id <ios-instance-id> "$DEV_CLIENT_URL" demonstrate the reliance on potentially untrusted variable data for execution parameters.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 06:23 AM
Security Audit — agent-trust-hub — limrun-expo-development