expo-cicd-workflows

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches JSON schemas and technical documentation from official Expo and GitHub repositories (api.expo.dev and raw.githubusercontent.com/expo/expo).
  • [COMMAND_EXECUTION]: Executes local Node.js scripts for caching resources and validating YAML files against schemas; also includes instructions for installing necessary NPM dependencies.
  • [DATA_EXFILTRATION]: Network activity is restricted to fetching public documentation and configuration from well-known services. No access to sensitive local files or credentials was observed.
  • [PROMPT_INJECTION]: Evaluated the surface for indirect prompt injection.
  • Ingestion points: Reads local workflow YAML files for validation and fetches external documentation from Expo's public repositories.
  • Boundary markers: No explicit delimiters are used when the agent processes the fetched content.
  • Capability inventory: Includes network access via fetch, local file system access for caching, and script execution via Node.js.
  • Sanitization: Uses the AJV library for schema-based structural validation of YAML data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 09:45 AM
Security Audit — agent-trust-hub — expo-cicd-workflows