integration-expo
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [SAFE]: The skill defines a structured integration process for the PostHog SDK within the Expo framework, utilizing standard practices such as environment variables for configuration and existing middleware for session management.
- [INDIRECT_PROMPT_INJECTION]: The agent is instructed to read and analyze 10 to 15 project files to determine business-critical events for tracking. This ingestion of external source code creates an indirect prompt injection surface where instructions embedded in project files could potentially influence agent behavior. However, this is a low-risk surface inherent to the skill's purpose.
- [PERSISTENCE]: The documentation provides instructions for setting up the development environment by adding exports for JAVA_HOME and ANDROID_HOME to shell profile files like .zshrc and .bashrc. While this interacts with shell configuration, it is a standard and necessary step for Android development and is clearly documented for the user.
Audit Metadata