expo-deployment
Fail
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends executing the
testflightpackage vianpxas a shortcut for iOS submissions. This is not an official Expo or Apple tool, and its execution from the public npm registry constitutes a remote code execution risk. - [DYNAMIC_EXECUTION]: The skill includes instructions for using JavaScript-based configuration files (
store.config.js) for EAS Metadata. These files are executed at runtime by the deployment CLI and the provided examples show the code performing network requests to external URLs to fetch data, creating a surface for dynamic code injection or data exfiltration. - [COMMAND_EXECUTION]: The skill provides multiple commands for building and submitting applications to production stores (Apple App Store and Google Play). These commands grant the agent the ability to perform significant infrastructure changes and production deployments.
- [CREDENTIALS_UNSAFE]: The skill manages highly sensitive deployment credentials, including Apple App Store Connect API keys (.p8 files) and Google Service Account JSON keys. The instructions involve referencing these files from the local filesystem, which presents a risk of accidental credential exposure if they are not correctly managed with environment variables or excluded via .gitignore.
Recommendations
- AI detected serious security threats
Audit Metadata