animate-expo
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting user requests for animation behavior and translating them into executable implementation code. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the user's requirements and reflected in the output code.
- Ingestion points: User requests for motion and UI interactions described in natural language are processed by the agent using the guidance in
SKILL.md. - Boundary markers: The skill does not implement specific boundary markers or instructions to the agent to treat user input as untrusted when generating code.
- Capability inventory: The skill involves generating React Native code that utilizes powerful animation and gesture libraries, and suggests the execution of installation commands such as
npx expo install(SKILL.md,RECIPES.md). - Sanitization: There are no specific instructions for the agent to sanitize or validate user-provided values or parameters before including them in the generated animation worklets or styles.
Audit Metadata