expo-dev-loop

SUSPICIOUS: the core Expo verification behavior is coherent and proportionate, with no credential harvesting or off-purpose data exfiltration. Risk comes mainly from supply-chain trust: it depends on an external global CLI and instructs installation of another skill, creating a transitive trust chain. Overall this looks like a legitimate workflow skill with moderate install-trust risk rather than malware.