react-native-engineering
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies the project environment by reading local configuration files such as package.json and app.json. \n
- Ingestion points: Project configuration data is read into the context using node -p and sed commands in SKILL.md. \n
- Boundary markers: No explicit delimiters are used to separate the read configuration content from the prompt context. \n
- Capability inventory: The skill utilizes standard subprocess calls for package management (npx expo install), project health checks (npx expo-doctor), and cloud builds (eas build). \n
- Sanitization: No explicit sanitization or validation is applied to the data extracted from the local project files. \n- [DYNAMIC_EXECUTION]: The skill uses node -p to execute small JavaScript snippets at runtime for the purpose of parsing versioning and dependency information from local JSON files. \n- [EXTERNAL_DOWNLOADS]: Recommends the installation of standard React Native and Expo development dependencies from the official NPM and Expo registries. \n- [COMMAND_EXECUTION]: The skill executes standard mobile development and build commands, including npx expo-doctor, npx expo install, and eas build, which are essential for the stated mobile engineering purpose.
Audit Metadata