upgrading-expo
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard development commands such as
npx expo install,npx expo-doctor,rm -rf node_modules, andpod install. These are routine operations for managing and upgrading React Native/Expo projects.- [EXTERNAL_DOWNLOADS]: The skill usesnpx expo installto download and update project dependencies from the official npm registry. It also references official documentation and resources fromexpo.devandexp.host.- [REMOTE_CODE_EXECUTION]: The skill facilitates automated code modification usingnpx expo-codemod, which fetches and runs scripts to assist in migrating navigation imports. This is an official migration path provided by Expo.- [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface by processing and acting upon project configuration files and application source code. - Ingestion points: Project configuration files (
package.json,app.json,postcss.config.js,metro.config.js) and application source code (viaexpo-codemod). - Boundary markers: Not explicitly present in the instructions.
- Capability inventory: Shell command execution via
npx, file system cleanup (rm -rf), and native project regeneration (npx expo prebuild). - Sanitization: Not present, as the tool is designed to process and modify these files directly.
Audit Metadata