expo-cicd-workflows
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads JSON schemas and documentation from official Expo domains (
api.expo.devandraw.githubusercontent.com/expo/expo). These are well-known, trusted sources for Expo development tools. - [COMMAND_EXECUTION]: The skill uses Node.js scripts to perform validation and caching. The commands
node {baseDir}/scripts/fetch.jsandnode {baseDir}/scripts/validate.jsare used to process workflow files locally. This is standard behavior for developer tools and does not involve arbitrary command execution or privilege escalation. - [NO_CODE]: The provided Node.js scripts (
fetch.js,validate.js) use standard libraries (node:crypto,node:fs,node:path) and reputable third-party packages (ajv,js-yaml) for their intended purposes of HTTP caching and YAML validation against a schema.
Audit Metadata