expo-brownfield
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill mentions
sudo gem install cocoapodsas a prerequisite for iOS development. This is a standard administrative command used to install the system-wide CocoaPods dependency manager on macOS.\n- [DYNAMIC_EXECUTION]: The provided Gradle configuration snippets includenodeshell executions to programmatically determine the paths of React Native and Expo dependencies. This logic is a standard and necessary part of the React Native autolinking process during build time.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines instructions for the agent to process project context and user-provided paths. While this establishes a surface for processing external data, the instructions are technical in nature and lack dangerous interpolation of untrusted strings into executable contexts.\n- [COMMAND_EXECUTION]: The skill provides instructions for running legitimate CLI tools such asnpx,yarn, andexpo-brownfield. These are standard tools within the mobile development ecosystem for managing dependencies and building artifacts.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes standard package managers (npm/npx, yarn) and well-known repositories (Maven Central, Google Maven, JitPack) to fetch required development tools and libraries.
Audit Metadata