expo-cicd-workflows
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches JSON schemas and technical documentation from official Expo and GitHub repositories (api.expo.dev and raw.githubusercontent.com/expo/expo).
- [COMMAND_EXECUTION]: Executes local Node.js scripts for caching resources and validating YAML files against schemas; also includes instructions for installing necessary NPM dependencies.
- [DATA_EXFILTRATION]: Network activity is restricted to fetching public documentation and configuration from well-known services. No access to sensitive local files or credentials was observed.
- [PROMPT_INJECTION]: Evaluated the surface for indirect prompt injection.
- Ingestion points: Reads local workflow YAML files for validation and fetches external documentation from Expo's public repositories.
- Boundary markers: No explicit delimiters are used when the agent processes the fetched content.
- Capability inventory: Includes network access via fetch, local file system access for caching, and script execution via Node.js.
- Sanitization: Uses the AJV library for schema-based structural validation of YAML data.
Audit Metadata