expo-observe

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of EAS CLI commands including eas observe:metrics-summary, eas observe:metrics, eas observe:routes, eas observe:events, and eas observe:versions. These are standard tools for querying performance telemetry from Expo's infrastructure.
  • [EXTERNAL_DOWNLOADS]: The documentation references installing official packages such as expo-observe, expo-router, and @react-navigation/native from the npm registry. These are verified libraries from a well-known development platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the agent's interpretation of performance metrics and custom event data, which inherently involves processing external, potentially untrusted strings.
  • Ingestion points: Command output from eas observe:events and eas observe:metrics (references/queries.md).
  • Boundary markers: No explicit delimiters or instructions are provided to sanitize or isolate telemetry content from agent instructions.
  • Capability inventory: The skill relies on standard EAS CLI interactions and Expo SDK APIs.
  • Sanitization: The guides do not describe any sanitization steps for the retrieved telemetry data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 06:07 AM