expo-observe
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of EAS CLI commands including
eas observe:metrics-summary,eas observe:metrics,eas observe:routes,eas observe:events, andeas observe:versions. These are standard tools for querying performance telemetry from Expo's infrastructure. - [EXTERNAL_DOWNLOADS]: The documentation references installing official packages such as
expo-observe,expo-router, and@react-navigation/nativefrom the npm registry. These are verified libraries from a well-known development platform. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the agent's interpretation of performance metrics and custom event data, which inherently involves processing external, potentially untrusted strings.
- Ingestion points: Command output from
eas observe:eventsandeas observe:metrics(references/queries.md). - Boundary markers: No explicit delimiters or instructions are provided to sanitize or isolate telemetry content from agent instructions.
- Capability inventory: The skill relies on standard EAS CLI interactions and Expo SDK APIs.
- Sanitization: The guides do not describe any sanitization steps for the retrieved telemetry data.
Audit Metadata