expo-nativewind-design
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard development commands including
npx expo install,typecheck,lint, andexpo start. These are used appropriately for managing project dependencies and verifying code quality within an Expo environment. - [EXTERNAL_DOWNLOADS]: References are made to well-known community libraries such as
react-native-keyboard-controllerandlottie-react-native. The skill also points to official documentation from Expo and React Native, and cites external design guidelines for industry context. - [PROMPT_INJECTION]: The skill processes project-specific data which presents a surface for indirect prompt injection. Ingestion points: The agent reads existing project files, theme tokens, UI components, assets, and user-supplied references to inform design decisions. Boundary markers: The skill mandates a step-by-step confirmation process where the agent must present a design brief and wait for user approval before modifying any files. Capability inventory: The agent can write React Native components, install packages via
npx expo, and execute project-defined linting and type-checking scripts. Sanitization: The instructions require adherence to existing project design tokens and semantic structures, though no automated content filtering is described. - [SAFE]: The skill incorporates defensive security practices by warning against the automatic installation of animations from untrusted sources and instructing the developer to keep authentication credentials separate from general application data payloads.
Audit Metadata