{"data":{"skill":{"slug":"callstackincubator-react-native-best-practices","name":"react-native-best-practices","icon":"📦","repo":"https://github.com/callstackincubator/agent-skills/tree/main/skills/react-native-best-practices/","status":"approved","author":"callstackincubator","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"93044934-5b8d-4217-bf1e-ea1321956069","skill_id":"83b02645-ff1b-4230-99b8-5ed263486fdc","version":3,"content_hash":"483a89f433fd942687dd75eb546278b9","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"Most static hits are false positives from Markdown examples, React Native documentation, local Gradle or grep commands, and benign PNG screenshots. Two curl-to-bash installer examples are confirmed critical because they execute a remote script, and the remote code loading guide adds a supply-chain concern without integrity controls. No prompt injection text was found in the reviewed files.","remediation":[{"issue":"Remote installer is piped directly into bash.","severity":"critical","suggestion":"Replace curl-to-bash instructions with a package manager install, a signed release download, or checksum verification before execution."},{"issue":"Remote code loading examples lack trust controls.","severity":"high","suggestion":"Add guidance for signed chunks, integrity validation, allowlisted hosts, rollback controls, and App Store or Play policy review."},{"issue":"Local shell commands are presented without execution safeguards.","severity":"medium","suggestion":"State that commands should run only with user approval in the project root, and explain what files or build outputs they change."},{"issue":"Binary screenshots require manual review during marketplace audits.","severity":"low","suggestion":"Keep images as simple documentation assets, strip unnecessary metadata, and avoid embedding instructions or secrets in screenshots."}],"risk_factor_evidence":[{"factor":"env_access","evidence":[{"file":"references/bundle-analyze-js.md","line_end":158,"line_start":158},{"file":"references/bundle-analyze-js.md","line_end":158,"line_start":158}]},{"factor":"filesystem","evidence":[{"file":"references/bundle-barrel-exports.md","line_end":219,"line_start":219},{"file":"references/bundle-code-splitting.md","line_end":184,"line_start":184},{"file":"references/bundle-code-splitting.md","line_end":191,"line_start":191},{"file":"references/bundle-hermes-mmap.md","line_end":4,"line_start":4},{"file":"references/bundle-hermes-mmap.md","line_end":35,"line_start":35},{"file":"references/bundle-hermes-mmap.md","line_end":135,"line_start":135},{"file":"references/native-android-16kb-alignment.md","line_end":80,"line_start":80},{"file":"references/native-android-16kb-alignment.md","line_end":83,"line_start":83},{"file":"references/native-measure-tti.md","line_end":262,"line_start":262},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":150,"line_start":150}]},{"factor":"scripts","evidence":[{"file":"references/bundle-code-splitting.md","line_end":23,"line_start":23},{"file":"references/bundle-code-splitting.md","line_end":66,"line_start":66},{"file":"references/bundle-code-splitting.md","line_end":68,"line_start":68},{"file":"references/bundle-code-splitting.md","line_end":118,"line_start":118},{"file":"references/bundle-code-splitting.md","line_end":148,"line_start":148},{"file":"references/bundle-library-size.md","line_end":165,"line_start":165},{"file":"references/bundle-tree-shaking.md","line_end":207,"line_start":207}]},{"factor":"external_commands","evidence":[{"file":"references/bundle-code-splitting.md","line_end":99,"line_start":95},{"file":"references/bundle-code-splitting.md","line_end":175,"line_start":170},{"file":"references/bundle-code-splitting.md","line_end":178,"line_start":175},{"file":"references/bundle-code-splitting.md","line_end":205,"line_start":201},{"file":"references/bundle-code-splitting.md","line_end":209,"line_start":205},{"file":"references/bundle-code-splitting.md","line_end":211,"line_start":209},{"file":"references/bundle-tree-shaking.md","line_end":36,"line_start":27},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":58,"line_start":55},{"file":"SKILL.md","line_end":64,"line_start":58},{"file":"SKILL.md","line_end":69,"line_start":64},{"file":"SKILL.md","line_end":78,"line_start":69},{"file":"SKILL.md","line_end":89,"line_start":78},{"file":"SKILL.md","line_end":95,"line_start":89},{"file":"SKILL.md","line_end":110,"line_start":95},{"file":"SKILL.md","line_end":112,"line_start":110},{"file":"SKILL.md","line_end":116,"line_start":112},{"file":"SKILL.md","line_end":117,"line_start":116},{"file":"SKILL.md","line_end":118,"line_start":117},{"file":"SKILL.md","line_end":119,"line_start":118},{"file":"SKILL.md","line_end":120,"line_start":119},{"file":"SKILL.md","line_end":121,"line_start":120},{"file":"SKILL.md","line_end":122,"line_start":121},{"file":"SKILL.md","line_end":123,"line_start":122},{"file":"SKILL.md","line_end":124,"line_start":123},{"file":"SKILL.md","line_end":126,"line_start":124},{"file":"SKILL.md","line_end":130,"line_start":126},{"file":"SKILL.md","line_end":131,"line_start":130},{"file":"SKILL.md","line_end":132,"line_start":131},{"file":"SKILL.md","line_end":133,"line_start":132},{"file":"SKILL.md","line_end":134,"line_start":133},{"file":"SKILL.md","line_end":135,"line_start":134},{"file":"SKILL.md","line_end":136,"line_start":135},{"file":"SKILL.md","line_end":137,"line_start":136},{"file":"SKILL.md","line_end":138,"line_start":137},{"file":"SKILL.md","line_end":139,"line_start":138},{"file":"SKILL.md","line_end":141,"line_start":139},{"file":"SKILL.md","line_end":145,"line_start":141},{"file":"SKILL.md","line_end":146,"line_start":145},{"file":"SKILL.md","line_end":147,"line_start":146},{"file":"SKILL.md","line_end":148,"line_start":147},{"file":"SKILL.md","line_end":149,"line_start":148},{"file":"SKILL.md","line_end":150,"line_start":149},{"file":"SKILL.md","line_end":151,"line_start":150},{"file":"SKILL.md","line_end":152,"line_start":151},{"file":"SKILL.md","line_end":153,"line_start":152},{"file":"SKILL.md","line_end":157,"line_start":153},{"file":"SKILL.md","line_end":165,"line_start":157},{"file":"SKILL.md","line_end":171,"line_start":165},{"file":"SKILL.md","line_end":171,"line_start":171},{"file":"SKILL.md","line_end":172,"line_start":172},{"file":"SKILL.md","line_end":173,"line_start":173},{"file":"SKILL.md","line_end":174,"line_start":174},{"file":"SKILL.md","line_end":175,"line_start":175},{"file":"SKILL.md","line_end":177,"line_start":176},{"file":"SKILL.md","line_end":178,"line_start":177},{"file":"SKILL.md","line_end":179,"line_start":178},{"file":"SKILL.md","line_end":179,"line_start":179}]},{"factor":"network","evidence":[{"file":"references/bundle-code-splitting.md","line_end":95,"line_start":95},{"file":"references/bundle-code-splitting.md","line_end":170,"line_start":170},{"file":"references/bundle-library-size.md","line_end":15,"line_start":15},{"file":"references/bundle-library-size.md","line_end":103,"line_start":103},{"file":"references/js-measure-fps.md","line_end":18,"line_start":18},{"file":"references/js-measure-fps.md","line_end":76,"line_start":76}]}],"critical_findings":[{"title":"Keylogger keywords","locations":[{"file":"references/js-concurrent-react.md","line_end":13,"line_start":13}],"confidence":1,"description":"**Incorrect (blocks input on every keystroke):**","review_kind":"false_positive","source_category":"blocker","source_severity":"critical","confidence_reasoning":"Force-confirmed blocker/critical static finding; AI dismissal overridden."},{"title":"Keylogger keywords","locations":[{"file":"references/js-concurrent-react.md","line_end":164,"line_start":164}],"confidence":1,"description":"<SlowComponent query={query} /> {/* Blocks every keystroke */}","review_kind":"false_positive","source_category":"blocker","source_severity":"critical","confidence_reasoning":"Force-confirmed blocker/critical static finding; AI dismissal overridden."},{"title":"Pipe to shell pattern","locations":[{"file":"references/js-measure-fps.md","line_end":18,"line_start":18}],"confidence":0.92,"description":"curl https://get.flashlight.dev | bash","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The snippet pipes a remote installer from get.flashlight.dev directly into bash. This executes unaudited network content on the user machine."},{"title":"Pipe to shell pattern","locations":[{"file":"references/js-measure-fps.md","line_end":76,"line_start":76}],"confidence":0.92,"description":"curl https://get.flashlight.dev | bash","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The snippet pipes a remote installer from get.flashlight.dev directly into bash. This executes unaudited network content on the user machine."}],"high_findings":[{"title":"Hardcoded URL","locations":[{"file":"references/js-measure-fps.md","line_end":18,"line_start":18}],"confidence":0.84,"description":"curl https://get.flashlight.dev | bash","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The URL is used as the source for a curl-to-bash installer. The external network dependency becomes code execution if the endpoint is compromised."},{"title":"Hardcoded URL","locations":[{"file":"references/js-measure-fps.md","line_end":76,"line_start":76}],"confidence":0.84,"description":"curl https://get.flashlight.dev | bash","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The URL is used as the source for a curl-to-bash installer. The external network dependency becomes code execution if the endpoint is compromised."},{"title":"Remote Code Loading Lacks Integrity Guidance","locations":[{"file":"references/bundle-code-splitting.md","line_end":96,"line_start":86},{"file":"references/bundle-code-splitting.md","line_end":149,"line_start":141},{"file":"references/bundle-code-splitting.md","line_end":176,"line_start":166}],"confidence":0.86,"description":"references/bundle-code-splitting.md presents production CDN chunk loading and module federation without signing, integrity, or allowlist guidance. A compromised CDN or remote module could execute untrusted JavaScript inside the app.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The file is explicitly about remote code loading and shows CDN chunk resolution plus module federation. The risk is contextual because the guide lacks trust, signing, or integrity controls."}],"medium_findings":[{"title":"Dynamic import() expression","locations":[{"file":"references/bundle-code-splitting.md","line_end":148,"line_start":148}],"confidence":0.66,"description":"import('remote-app/Module')","review_kind":"capability","source_category":"scripts","source_severity":"medium","confidence_reasoning":"The example imports a module from a remote-app namespace in a remote code loading guide. This can execute code supplied outside the shipped app bundle."},{"title":"Hardcoded URL","locations":[{"file":"references/bundle-code-splitting.md","line_end":95,"line_start":95}],"confidence":0.68,"description":": `https://my-cdn.com/assets/${scriptId}`,  // Production CDN","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The hardcoded URL is part of production remote chunk loading. Without integrity controls, it can fetch executable app code from a CDN."},{"title":"Hardcoded URL","locations":[{"file":"references/bundle-code-splitting.md","line_end":170,"line_start":170}],"confidence":0.68,"description":"url: `https://my-cdn.com/${scriptId}`,","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The hardcoded URL is part of production remote chunk loading. Without integrity controls, it can fetch executable app code from a CDN."}],"low_findings":[{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/expo-atlas-treemap.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/xcode-instruments-templates.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/tti-warm-start-diagram.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/devtools-flamegraph.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/fps-drop-graph.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/view-hierarchy-flattening.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/memory-heap-snapshot.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/flashlight-flatlist-vs-flashlist.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/controlled-textinput-pingpong.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/bundle-treemap-source-map-explorer.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/xcode-thread-view.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/emerge-xray-ios.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"false_positive","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI dismissal overridden."}],"dangerous_patterns":[{"title":"Keylogger keywords","locations":[{"file":"references/js-concurrent-react.md","line_end":13,"line_start":13}],"confidence":1,"description":"**Incorrect (blocks input on every keystroke):**","review_kind":"false_positive","source_category":"blocker","source_severity":"critical","confidence_reasoning":"Force-confirmed blocker/critical static finding; AI dismissal overridden."},{"title":"Keylogger keywords","locations":[{"file":"references/js-concurrent-react.md","line_end":164,"line_start":164}],"confidence":1,"description":"<SlowComponent query={query} /> {/* Blocks every keystroke */}","review_kind":"false_positive","source_category":"blocker","source_severity":"critical","confidence_reasoning":"Force-confirmed blocker/critical static finding; AI dismissal overridden."},{"title":"Pipe to shell pattern","locations":[{"file":"references/js-measure-fps.md","line_end":18,"line_start":18}],"confidence":0.92,"description":"curl https://get.flashlight.dev | bash","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The snippet pipes a remote installer from get.flashlight.dev directly into bash. This executes unaudited network content on the user machine."},{"title":"Pipe to shell pattern","locations":[{"file":"references/js-measure-fps.md","line_end":76,"line_start":76}],"confidence":0.92,"description":"curl https://get.flashlight.dev | bash","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The snippet pipes a remote installer from get.flashlight.dev directly into bash. This executes unaudited network content on the user machine."}],"files_scanned":29,"total_lines":6499,"audit_model":"codex","audited_at":"2026-07-05T06:20:36.084+00:00","created_at":"2026-07-05T08:32:31.514648+00:00","static_findings":[{"id":"blocker:references/bundle-analyze-app.md:9:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"Measure iOS and Android app download/install sizes using Ruler, App Store Connect, and Emerge Tools.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/bundle-analyze-app.md:14:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"# Android (Ruler)","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:references/bundle-analyze-app.md:15:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew analyzeReleaseBundle","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:references/bundle-analyze-app.md:73:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"cd android","category":"blocker","line_end":74,"severity":"low","line_start":73},{"id":"blocker:references/bundle-analyze-app.md:161:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"| Ruler | Android | High | Yes (Gradle) |","category":"blocker","line_end":161,"severity":"low","line_start":161},{"id":"blocker:references/bundle-analyze-app.md:189:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"# Android release bundle size","category":"blocker","line_end":189,"severity":"low","line_start":189},{"id":"blocker:references/bundle-analyze-app.md:190:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew bundleRelease","category":"blocker","line_end":190,"severity":"low","line_start":190},{"id":"blocker:references/bundle-analyze-app.md:209:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"- [bundle-r8-android.md](./bundle-r8-android.md) - Reduce Android size","category":"blocker","line_end":209,"severity":"low","line_start":209},{"id":"env_access:references/bundle-analyze-js.md:158:environment-variable-access-dot-notation","file":"references/bundle-analyze-js.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.RSDOCTOR && new RsdoctorRspackPlugin(),","category":"env_access","line_end":158,"severity":"low","line_start":158},{"id":"env_access:references/bundle-analyze-js.md:158:environment-variable-object","file":"references/bundle-analyze-js.md","pattern":"Environment variable object","snippet":"process.env.RSDOCTOR && new RsdoctorRspackPlugin(),","category":"env_access","line_end":158,"severity":"low","line_start":158},{"id":"sensitive:references/bundle-analyze-js.md:158:environment-file-access","file":"references/bundle-analyze-js.md","pattern":"Environment file access","snippet":"process.env.RSDOCTOR && new RsdoctorRspackPlugin(),","category":"sensitive","line_end":158,"severity":"high","line_start":158},{"id":"blocker:references/bundle-analyze-js.md:140:system-reconnaissance","file":"references/bundle-analyze-js.md","pattern":"System reconnaissance","snippet":"--platform android \\","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"blocker:references/bundle-analyze-js.md:239:system-reconnaissance","file":"references/bundle-analyze-js.md","pattern":"System reconnaissance","snippet":"# Android bundle analysis","category":"blocker","line_end":239,"severity":"low","line_start":239},{"id":"blocker:references/bundle-analyze-js.md:243:system-reconnaissance","file":"references/bundle-analyze-js.md","pattern":"System reconnaissance","snippet":"--platform android \\","category":"blocker","line_end":243,"severity":"low","line_start":243},{"id":"filesystem:references/bundle-barrel-exports.md:219:path-traversal-sequence","file":"references/bundle-barrel-exports.md","pattern":"Path traversal sequence","snippet":"import Button from '../components/Button';","category":"filesystem","line_end":219,"severity":"high","line_start":219},{"id":"sensitive:references/bundle-barrel-exports.md:138:environment-file-access","file":"references/bundle-barrel-exports.md","pattern":"Environment file access","snippet":"# .env","category":"sensitive","line_end":138,"severity":"high","line_start":138},{"id":"blocker:references/bundle-barrel-exports.md:2:system-reconnaissance","file":"references/bundle-barrel-exports.md","pattern":"System reconnaissance","snippet":"title: Avoid Barrel Exports","category":"blocker","line_end":2,"severity":"low","line_start":2},{"id":"blocker:references/bundle-barrel-exports.md:7:system-reconnaissance","file":"references/bundle-barrel-exports.md","pattern":"System reconnaissance","snippet":"# Skill: Avoid Barrel Exports","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"scripts:references/bundle-code-splitting.md:23:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"import(/* webpackChunkName: \"settings\" */ './screens/SettingsScreen')","category":"scripts","line_end":23,"severity":"medium","line_start":23},{"id":"scripts:references/bundle-code-splitting.md:66:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"// AFTER: Dynamic import (creates split point)","category":"scripts","line_end":66,"severity":"medium","line_start":66},{"id":"scripts:references/bundle-code-splitting.md:68:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"import(/* webpackChunkName: \"settings\" */ './screens/SettingsScreen')","category":"scripts","line_end":68,"severity":"medium","line_start":68},{"id":"scripts:references/bundle-code-splitting.md:118:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"import(/* webpackChunkName: \"heavy-feature\" */ './HeavyFeature')","category":"scripts","line_end":118,"severity":"medium","line_start":118},{"id":"scripts:references/bundle-code-splitting.md:148:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"import('remote-app/Module')","category":"scripts","line_end":148,"severity":"medium","line_start":148},{"id":"external_commands:references/bundle-code-splitting.md:95:ruby-shell-backtick-execution","file":"references/bundle-code-splitting.md","pattern":"Ruby/shell backtick execution","snippet":": `https://my-cdn.com/assets/${scriptId}`,  // Production CDN","category":"external_commands","line_end":99,"severity":"medium","line_start":95},{"id":"external_commands:references/bundle-code-splitting.md:170:ruby-shell-backtick-execution","file":"references/bundle-code-splitting.md","pattern":"Ruby/shell backtick execution","snippet":"url: `https://my-cdn.com/${scriptId}`,","category":"external_commands","line_end":175,"severity":"medium","line_start":170},{"id":"external_commands:references/bundle-code-splitting.md:175:ruby-shell-backtick-execution","file":"references/bundle-code-splitting.md","pattern":"Ruby/shell backtick execution","snippet":"path: `${FileSystem.cacheDirectory}/chunks/`,","category":"external_commands","line_end":178,"severity":"medium","line_start":175},{"id":"external_commands:references/bundle-code-splitting.md:201:ruby-shell-backtick-execution","file":"references/bundle-code-splitting.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Loading: ${scriptId}`);","category":"external_commands","line_end":205,"severity":"medium","line_start":201},{"id":"external_commands:references/bundle-code-splitting.md:205:ruby-shell-backtick-execution","file":"references/bundle-code-splitting.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Loaded: ${scriptId}`);","category":"external_commands","line_end":209,"severity":"medium","line_start":205},{"id":"external_commands:references/bundle-code-splitting.md:209:ruby-shell-backtick-execution","file":"references/bundle-code-splitting.md","pattern":"Ruby/shell backtick execution","snippet":"console.error(`Failed: ${scriptId}`, error);","category":"external_commands","line_end":211,"severity":"medium","line_start":209},{"id":"network:references/bundle-code-splitting.md:95:hardcoded-url","file":"references/bundle-code-splitting.md","pattern":"Hardcoded URL","snippet":": `https://my-cdn.com/assets/${scriptId}`,  // Production CDN","category":"network","line_end":95,"severity":"low","line_start":95},{"id":"network:references/bundle-code-splitting.md:170:hardcoded-url","file":"references/bundle-code-splitting.md","pattern":"Hardcoded URL","snippet":"url: `https://my-cdn.com/${scriptId}`,","category":"network","line_end":170,"severity":"low","line_start":170},{"id":"filesystem:references/bundle-code-splitting.md:184:memory-mapped-file-access","file":"references/bundle-code-splitting.md","pattern":"Memory-mapped file access","snippet":"| Using Hermes | mmap already efficient |","category":"filesystem","line_end":184,"severity":"high","line_start":184},{"id":"filesystem:references/bundle-code-splitting.md:191:memory-mapped-file-access","file":"references/bundle-code-splitting.md","pattern":"Memory-mapped file access","snippet":"Hermes reads bytecode lazily via mmap:","category":"filesystem","line_end":191,"severity":"high","line_start":191},{"id":"filesystem:references/bundle-hermes-mmap.md:4:memory-mapped-file-access","file":"references/bundle-hermes-mmap.md","pattern":"Memory-mapped file access","snippet":"tags: android, hermes, mmap, tti, startup","category":"filesystem","line_end":4,"severity":"high","line_start":4},{"id":"filesystem:references/bundle-hermes-mmap.md:35:memory-mapped-file-access","file":"references/bundle-hermes-mmap.md","pattern":"Memory-mapped file access","snippet":"**Problem**: Compressed files can't be memory-mapped (mmap).","category":"filesystem","line_end":35,"severity":"high","line_start":35},{"id":"filesystem:references/bundle-hermes-mmap.md:135:memory-mapped-file-access","file":"references/bundle-hermes-mmap.md","pattern":"Memory-mapped file access","snippet":"If you have other files that benefit from mmap:","category":"filesystem","line_end":135,"severity":"high","line_start":135},{"id":"blocker:references/bundle-hermes-mmap.md:9:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"Disable Android JS bundle compression to enable Hermes memory mapping for faster startup.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/bundle-hermes-mmap.md:15:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:references/bundle-hermes-mmap.md:26:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"- Android app using Hermes","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:references/bundle-hermes-mmap.md:33:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"Android compresses most files in APK/AAB by default, including `index.android.bundle`.","category":"blocker","line_end":33,"severity":"low","line_start":33},{"id":"blocker:references/bundle-hermes-mmap.md:48:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"1. Android decompresses entire bundle","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:references/bundle-hermes-mmap.md:60:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":60,"severity":"low","line_start":60},{"id":"blocker:references/bundle-hermes-mmap.md:70:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":70,"severity":"low","line_start":70},{"id":"blocker:references/bundle-hermes-mmap.md:93:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"cd android","category":"blocker","line_end":94,"severity":"low","line_start":93},{"id":"scripts:references/bundle-library-size.md:165:dynamic-import-expression","file":"references/bundle-library-size.md","pattern":"Dynamic import() expression","snippet":"// BETTER: Specific import (8 KB)","category":"scripts","line_end":165,"severity":"medium","line_start":165},{"id":"network:references/bundle-library-size.md:15:hardcoded-url","file":"references/bundle-library-size.md","pattern":"Hardcoded URL","snippet":"# Visit: https://bundlephobia.com/package/[package-name]","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:references/bundle-library-size.md:103:hardcoded-url","file":"references/bundle-library-size.md","pattern":"Hardcoded URL","snippet":"https://bundlephobia.com/package/[package-name]","category":"network","line_end":103,"severity":"low","line_start":103},{"id":"blocker:references/bundle-native-assets.md:47:system-reconnaissance","file":"references/bundle-native-assets.md","pattern":"System reconnaissance","snippet":"Android handles this automatically.","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:references/bundle-native-assets.md:53:system-reconnaissance","file":"references/bundle-native-assets.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew bundleRelease","category":"blocker","line_end":53,"severity":"low","line_start":53},{"id":"blocker:references/bundle-native-assets.md:214:system-reconnaissance","file":"references/bundle-native-assets.md","pattern":"System reconnaissance","snippet":"- [bundle-r8-android.md](./bundle-r8-android.md) - Android code optimization","category":"blocker","line_end":214,"severity":"low","line_start":214},{"id":"blocker:references/bundle-r8-android.md:9:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"Enable R8 for Android to shrink, optimize, and obfuscate native code.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/bundle-r8-android.md:17:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":17,"severity":"low","line_start":17},{"id":"blocker:references/bundle-r8-android.md:29:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"- Android app size too large","category":"blocker","line_end":29,"severity":"low","line_start":29},{"id":"blocker:references/bundle-r8-android.md:59:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":59,"severity":"low","line_start":59},{"id":"blocker:references/bundle-r8-android.md:96:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"cd android","category":"blocker","line_end":97,"severity":"low","line_start":96},{"id":"scripts:references/bundle-tree-shaking.md:207:dynamic-require-with-variable","file":"references/bundle-tree-shaking.md","pattern":"Dynamic require with variable","snippet":"- **Dynamic imports**: `require(variable)` prevents analysis","category":"scripts","line_end":207,"severity":"medium","line_start":207},{"id":"external_commands:references/bundle-tree-shaking.md:27:ruby-shell-backtick-execution","file":"references/bundle-tree-shaking.md","pattern":"Ruby/shell backtick execution","snippet":"// babel.config.js (non-Expo projects must set `disableImportExportTransform`)","category":"external_commands","line_end":36,"severity":"medium","line_start":27},{"id":"sensitive:references/bundle-tree-shaking.md:14:environment-file-access","file":"references/bundle-tree-shaking.md","pattern":"Environment file access","snippet":"# .env (Expo SDK 52+)","category":"sensitive","line_end":14,"severity":"high","line_start":14},{"id":"sensitive:references/bundle-tree-shaking.md:74:environment-file-access","file":"references/bundle-tree-shaking.md","pattern":"Environment file access","snippet":"Create/edit `.env`:","category":"sensitive","line_end":74,"severity":"high","line_start":74},{"id":"blocker:references/bundle-tree-shaking.md:118:system-reconnaissance","file":"references/bundle-tree-shaking.md","pattern":"System reconnaissance","snippet":"// Removed from Android bundle","category":"blocker","line_end":118,"severity":"low","line_start":118},{"id":"blocker:references/bundle-tree-shaking.md:122:system-reconnaissance","file":"references/bundle-tree-shaking.md","pattern":"System reconnaissance","snippet":"// Removed from Android bundle","category":"blocker","line_end":122,"severity":"low","line_start":122},{"id":"blocker:references/bundle-tree-shaking.md:205:network-reconnaissance","file":"references/bundle-tree-shaking.md","pattern":"Network reconnaissance","snippet":"- **CommonJS modules**: Need ESM for full effectiveness","category":"blocker","line_end":206,"severity":"low","line_start":205},{"id":"blocker:references/js-animations-reanimated.md:266:system-reconnaissance","file":"references/js-animations-reanimated.md","pattern":"System reconnaissance","snippet":"> **Can't upgrade to v4?** If your project is blocked from migrating to New Architecture (e.g., inco","category":"blocker","line_end":266,"severity":"low","line_start":266},{"id":"blocker:references/js-atomic-state.md:32:system-reconnaissance","file":"references/js-atomic-state.md","pattern":"System reconnaissance","snippet":"- Want to avoid manual `useMemo`/`useCallback` everywhere","category":"blocker","line_end":32,"severity":"low","line_start":32},{"id":"blocker:references/js-atomic-state.md:111:system-reconnaissance","file":"references/js-atomic-state.md","pattern":"System reconnaissance","snippet":"const TodoItem = ({ id }) => {","category":"blocker","line_end":111,"severity":"low","line_start":111},{"id":"blocker:references/js-atomic-state.md:116:system-reconnaissance","file":"references/js-atomic-state.md","pattern":"System reconnaissance","snippet":"prev.map((t) => t.id === id ? { ...t, completed: !t.completed } : t)","category":"blocker","line_end":116,"severity":"low","line_start":116},{"id":"blocker:references/js-atomic-state.md:139:system-reconnaissance","file":"references/js-atomic-state.md","pattern":"System reconnaissance","snippet":"t.id === id ? { ...t, completed: !t.completed } : t","category":"blocker","line_end":139,"severity":"low","line_start":139},{"id":"blocker:references/js-concurrent-react.md:13:keylogger-keywords","file":"references/js-concurrent-react.md","pattern":"Keylogger keywords","snippet":"**Incorrect (blocks input on every keystroke):**","category":"blocker","line_end":13,"severity":"critical","line_start":13},{"id":"blocker:references/js-concurrent-react.md:164:keylogger-keywords","file":"references/js-concurrent-react.md","pattern":"Keylogger keywords","snippet":"<SlowComponent query={query} /> {/* Blocks every keystroke */}","category":"blocker","line_end":164,"severity":"critical","line_start":164},{"id":"blocker:references/js-lists-flatlist-flashlist.md:202:system-reconnaissance","file":"references/js-lists-flatlist-flashlist.md","pattern":"System reconnaissance","snippet":"// Avoid re-renders","category":"blocker","line_end":202,"severity":"low","line_start":202},{"id":"network:references/js-measure-fps.md:18:hardcoded-url","file":"references/js-measure-fps.md","pattern":"Hardcoded URL","snippet":"curl https://get.flashlight.dev | bash","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:references/js-measure-fps.md:76:hardcoded-url","file":"references/js-measure-fps.md","pattern":"Hardcoded URL","snippet":"curl https://get.flashlight.dev | bash","category":"network","line_end":76,"severity":"low","line_start":76},{"id":"blocker:references/js-measure-fps.md:18:pipe-to-shell-pattern","file":"references/js-measure-fps.md","pattern":"Pipe to shell pattern","snippet":"curl https://get.flashlight.dev | bash","category":"blocker","line_end":18,"severity":"critical","line_start":18},{"id":"blocker:references/js-measure-fps.md:76:pipe-to-shell-pattern","file":"references/js-measure-fps.md","pattern":"Pipe to shell pattern","snippet":"curl https://get.flashlight.dev | bash","category":"blocker","line_end":76,"severity":"critical","line_start":76},{"id":"blocker:references/js-measure-fps.md:32:system-reconnaissance","file":"references/js-measure-fps.md","pattern":"System reconnaissance","snippet":"- For Flashlight: Android device (iOS not supported)","category":"blocker","line_end":32,"severity":"low","line_start":32},{"id":"blocker:references/js-measure-fps.md:42:system-reconnaissance","file":"references/js-measure-fps.md","pattern":"System reconnaissance","snippet":"- Android Emulator: `Cmd + M` (Mac) / `Ctrl + M` (Windows)","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:references/js-measure-fps.md:60:system-reconnaissance","file":"references/js-measure-fps.md","pattern":"System reconnaissance","snippet":"> Android only. Provides detailed reports and JSON export.","category":"blocker","line_end":60,"severity":"low","line_start":60},{"id":"blocker:references/js-profile-react.md:71:system-reconnaissance","file":"references/js-profile-react.md","pattern":"System reconnaissance","snippet":"- **Gray components**: Did not render","category":"blocker","line_end":71,"severity":"low","line_start":71},{"id":"blocker:references/js-profile-react.md:73:system-reconnaissance","file":"references/js-profile-react.md","pattern":"System reconnaissance","snippet":"**Right panel shows \"Why did this render?\":**","category":"blocker","line_end":73,"severity":"low","line_start":73},{"id":"blocker:references/js-profile-react.md:155:system-reconnaissance","file":"references/js-profile-react.md","pattern":"System reconnaissance","snippet":"- **Ignoring \"Why did this render?\"**: This tells you exactly what to fix","category":"blocker","line_end":155,"severity":"low","line_start":155},{"id":"filesystem:references/native-android-16kb-alignment.md:80:standard-device-file-access","file":"references/native-android-16kb-alignment.md","pattern":"Standard device file access","snippet":"find node_modules -name \"libfoo.so\" 2>/dev/null","category":"filesystem","line_end":80,"severity":"low","line_start":80},{"id":"filesystem:references/native-android-16kb-alignment.md:83:standard-device-file-access","file":"references/native-android-16kb-alignment.md","pattern":"Standard device file access","snippet":"grep -r \"foo\" node_modules/*/android --include=\"*.gradle\" 2>/dev/null","category":"filesystem","line_end":83,"severity":"low","line_start":83},{"id":"blocker:references/native-android-16kb-alignment.md:2:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"title: Android 16 KB Page Size Alignment","category":"blocker","line_end":2,"severity":"low","line_start":2},{"id":"blocker:references/native-android-16kb-alignment.md:7:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"# Android 16 KB page size alignment","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"blocker:references/native-android-16kb-alignment.md:15:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"| Google Play deadline   | November 1, 2025 for apps targeting Android 15+      |","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:references/native-android-16kb-alignment.md:47:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"* Investigating crashes on Android 15+ devices with 16 KB page size","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:references/native-android-16kb-alignment.md:67:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"For runtime testing, use the [16KB Android Emulator image][] or enable","category":"blocker","line_end":67,"severity":"low","line_start":67},{"id":"blocker:references/native-android-16kb-alignment.md:70:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"[16KB Android Emulator image]: https://developer.android.com/guide/practices/page-sizes#set-up-the-a","category":"blocker","line_end":70,"severity":"low","line_start":70},{"id":"blocker:references/native-android-16kb-alignment.md:83:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"grep -r \"foo\" node_modules/*/android --include=\"*.gradle\" 2>/dev/null","category":"blocker","line_end":83,"severity":"low","line_start":83},{"id":"filesystem:references/native-measure-tti.md:262:memory-mapped-file-access","file":"references/native-measure-tti.md","pattern":"Memory-mapped file access","snippet":"- [bundle-hermes-mmap.md](./bundle-hermes-mmap.md) - Improve Android TTI","category":"filesystem","line_end":262,"severity":"high","line_start":262},{"id":"blocker:references/native-measure-tti.md:91:system-reconnaissance","file":"references/native-measure-tti.md","pattern":"System reconnaissance","snippet":"**Android (Kotlin):**","category":"blocker","line_end":91,"severity":"low","line_start":91},{"id":"blocker:references/native-measure-tti.md:229:system-reconnaissance","file":"references/native-measure-tti.md","pattern":"System reconnaissance","snippet":"**Android (JS Bundle Load):**","category":"blocker","line_end":229,"severity":"low","line_start":229},{"id":"blocker:references/native-measure-tti.md:262:system-reconnaissance","file":"references/native-measure-tti.md","pattern":"System reconnaissance","snippet":"- [bundle-hermes-mmap.md](./bundle-hermes-mmap.md) - Improve Android TTI","category":"blocker","line_end":262,"severity":"low","line_start":262},{"id":"blocker:references/native-memory-leaks.md:9:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"Find native memory leaks using Xcode Leaks and Android Studio Memory Profiler.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/native-memory-leaks.md:18:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"# Android Studio → Run → Profile → Track Memory Consumption","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:references/native-memory-leaks.md:70:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"void createNewStrings() {","category":"blocker","line_end":70,"severity":"low","line_start":70},{"id":"blocker:references/native-memory-leaks.md:76:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"void createNewStrings() {","category":"blocker","line_end":76,"severity":"low","line_start":76},{"id":"blocker:references/native-memory-leaks.md:83:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"void createNewStrings() {","category":"blocker","line_end":83,"severity":"low","line_start":83},{"id":"blocker:references/native-memory-leaks.md:112:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"### Common Android Leak: Listener Not Removed","category":"blocker","line_end":112,"severity":"low","line_start":112},{"id":"blocker:references/native-memory-leaks.md:140:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"Android recreates activities on:","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"blocker:references/native-memory-leaks.md:159:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"### Android","category":"blocker","line_end":161,"severity":"low","line_start":159},{"id":"blocker:references/native-memory-leaks.md:193:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"void process() {","category":"blocker","line_end":193,"severity":"low","line_start":193},{"id":"blocker:references/native-memory-leaks.md:200:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"void process() {","category":"blocker","line_end":200,"severity":"low","line_start":200},{"id":"blocker:references/native-memory-patterns.md:43:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"void takeOwnership(std::unique_ptr<std::string> s) {","category":"blocker","line_end":43,"severity":"low","line_start":43},{"id":"blocker:references/native-memory-patterns.md:62:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"void useShared(std::shared_ptr<std::string> s) {","category":"blocker","line_end":62,"severity":"low","line_start":62},{"id":"blocker:references/native-memory-patterns.md:66:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"void useReference(const std::shared_ptr<std::string>& s) {","category":"blocker","line_end":66,"severity":"low","line_start":66},{"id":"blocker:references/native-memory-patterns.md:76:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"std::cout << *str;   // Still valid","category":"blocker","line_end":77,"severity":"low","line_start":76},{"id":"blocker:references/native-memory-patterns.md:84:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"void useWeak(std::weak_ptr<std::string> weak) {","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"blocker:references/native-memory-patterns.md:143:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"## Kotlin/Android GC","category":"blocker","line_end":143,"severity":"low","line_start":143},{"id":"blocker:references/native-platform-setup.md:9:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"Navigate iOS and Android tooling, dependency management, and build systems in React Native.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/native-platform-setup.md:17:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"| Android | Android Studio | Gradle | Gradle |","category":"blocker","line_end":17,"severity":"low","line_start":17},{"id":"blocker:references/native-platform-setup.md:22:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew clean       # Clean Android build","category":"blocker","line_end":22,"severity":"low","line_start":22},{"id":"blocker:references/native-platform-setup.md:39:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"| Android | Android Studio | Layout Inspector, Profiler, Logcat |","category":"blocker","line_end":39,"severity":"low","line_start":39},{"id":"blocker:references/native-platform-setup.md:81:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"### Android (Gradle)","category":"blocker","line_end":81,"severity":"low","line_start":81},{"id":"blocker:references/native-platform-setup.md:85:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew clean","category":"blocker","line_end":85,"severity":"low","line_start":85},{"id":"blocker:references/native-platform-setup.md:94:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"**Adding a native Android dependency:**","category":"blocker","line_end":94,"severity":"low","line_start":94},{"id":"blocker:references/native-platform-setup.md:119:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"### Android Build Pipeline","category":"blocker","line_end":119,"severity":"low","line_start":119},{"id":"blocker:references/native-platform-setup.md:122:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"2. **DEX Conversion**: `.class` → `.dex` (Android Runtime)","category":"blocker","line_end":122,"severity":"low","line_start":122},{"id":"blocker:references/native-platform-setup.md:145:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"### Android Emulator","category":"blocker","line_end":145,"severity":"low","line_start":145},{"id":"blocker:references/native-platform-setup.md:162:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"- **Android iOS Emulator (VS Code)**: IDE integration","category":"blocker","line_end":162,"severity":"low","line_start":162},{"id":"blocker:references/native-platform-setup.md:172:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"# Android","category":"blocker","line_end":173,"severity":"low","line_start":172},{"id":"blocker:references/native-platform-setup.md:173:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew clean          # Clean build","category":"blocker","line_end":173,"severity":"low","line_start":173},{"id":"blocker:references/native-platform-setup.md:180:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"npx react-native run-android           # Run on Android","category":"blocker","line_end":180,"severity":"low","line_start":180},{"id":"blocker:references/native-platform-setup.md:185:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"npx expo run:android                   # Run on Android (dev client)","category":"blocker","line_end":185,"severity":"low","line_start":185},{"id":"blocker:references/native-platform-setup.md:201:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"| Android Gradle sync fails | `./gradlew clean` then sync |","category":"blocker","line_end":201,"severity":"low","line_start":201},{"id":"blocker:references/native-profiling.md:9:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"Use Xcode Instruments and Android Studio Profiler to identify native performance bottlenecks.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/native-profiling.md:18:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"# Android Studio → View → Tool Windows → Profiler","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:references/native-profiling.md:29:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"> **Note**: This skill involves interpreting visual profiler output (Xcode Instruments, Android Stud","category":"blocker","line_end":29,"severity":"low","line_start":29},{"id":"blocker:references/native-profiling.md:76:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"## Android Profiling with Android Studio","category":"blocker","line_end":76,"severity":"low","line_start":76},{"id":"blocker:references/native-profiling.md:137:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"| CPU Profiler | Android | CPU hotspots |","category":"blocker","line_end":137,"severity":"low","line_start":137},{"id":"blocker:references/native-profiling.md:138:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"| Memory Profiler | Android | Memory tracking |","category":"blocker","line_end":138,"severity":"low","line_start":138},{"id":"blocker:references/native-profiling.md:139:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"| Perfetto | Android | Advanced trace analysis |","category":"blocker","line_end":139,"severity":"low","line_start":139},{"id":"blocker:references/native-profiling.md:143:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"Export traces from Android Studio and analyze at [ui.perfetto.dev](https://ui.perfetto.dev/):","category":"blocker","line_end":143,"severity":"low","line_start":143},{"id":"blocker:references/native-profiling.md:160:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"- **Dev Client / Prebuild**: Full native profiling supported via Xcode/Android Studio","category":"blocker","line_end":160,"severity":"low","line_start":160},{"id":"blocker:references/native-profiling.md:63:network-reconnaissance","file":"references/native-profiling.md","pattern":"Network reconnaissance","snippet":"- **Microhang**: Brief UI unresponsiveness","category":"blocker","line_end":64,"severity":"low","line_start":63},{"id":"blocker:references/native-threading-model.md:13:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Action | iOS Thread | Android Thread |","category":"blocker","line_end":13,"severity":"low","line_start":13},{"id":"blocker:references/native-threading-model.md:34:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Main/UI | Main thread | UI rendering, UIKit/Android Views |","category":"blocker","line_end":34,"severity":"low","line_start":34},{"id":"blocker:references/native-threading-model.md:46:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Android (lazy) | JS thread | Default behavior |","category":"blocker","line_end":46,"severity":"low","line_start":46},{"id":"blocker:references/native-threading-model.md:47:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Android (eager) | Native modules thread | When `needsEagerInit = true` |","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:references/native-threading-model.md:51:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"**Android Eager Loading:**","category":"blocker","line_end":51,"severity":"low","line_start":51},{"id":"blocker:references/native-threading-model.md:105:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"// Android - runs on native modules thread","category":"blocker","line_end":105,"severity":"low","line_start":105},{"id":"blocker:references/native-threading-model.md:119:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Android | ReactHost thread pool |","category":"blocker","line_end":119,"severity":"low","line_start":119},{"id":"blocker:references/native-threading-model.md:133:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"Views always manipulate UI on main thread (UIKit/Android requirement).","category":"blocker","line_end":133,"severity":"low","line_start":133},{"id":"blocker:references/native-threading-model.md:221:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Action | iOS Thread | Android Thread |","category":"blocker","line_end":221,"severity":"low","line_start":221},{"id":"blocker:references/native-turbo-modules.md:62:system-reconnaissance","file":"references/native-turbo-modules.md","pattern":"System reconnaissance","snippet":"- Android (Kotlin) support","category":"blocker","line_end":62,"severity":"low","line_start":62},{"id":"blocker:references/native-turbo-modules.md:249:system-reconnaissance","file":"references/native-turbo-modules.md","pattern":"System reconnaissance","snippet":"// Android implementation","category":"blocker","line_end":249,"severity":"low","line_start":249},{"id":"blocker:references/native-view-flattening.md:38:system-reconnaissance","file":"references/native-view-flattening.md","pattern":"System reconnaissance","snippet":"> **Note**: This skill involves interpreting visual view hierarchy tools (Xcode Debug View Hierarchy","category":"blocker","line_end":38,"severity":"low","line_start":38},{"id":"blocker:references/native-view-flattening.md:100:system-reconnaissance","file":"references/native-view-flattening.md","pattern":"System reconnaissance","snippet":"### Android Studio","category":"blocker","line_end":100,"severity":"low","line_start":100},{"id":"blocker:references/native-view-flattening.md:102:system-reconnaissance","file":"references/native-view-flattening.md","pattern":"System reconnaissance","snippet":"1. Run app via Android Studio","category":"blocker","line_end":102,"severity":"low","line_start":102},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 1 | FPS & Re-renders | CRITICAL | `js-*` |","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 2 | Bundle Size | CRITICAL | `bundle-*` |","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 3 | TTI Optimization | HIGH | `native-*`, `bundle-*` |","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 4 | Native Performance | HIGH | `native-*` |","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 5 | Memory Management | MEDIUM-HIGH | `js-*`, `native-*` |","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 6 | Animations | MEDIUM | `js-*` |","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":58,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":64,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `useDeferredValue` for expensive computations","category":"external_commands","line_end":69,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":78,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `react-native-performance` for markers","category":"external_commands","line_end":95,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Defer non-critical work with `InteractionManager`","category":"external_commands","line_end":110,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Full documentation with code examples in `references/`:","category":"external_commands","line_end":112,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### JavaScript/React (`js-*`)","category":"external_commands","line_end":116,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `js-lists-flatlist-flashlist.md` | CRITICAL | Replace ScrollView with virtualized lists |","category":"external_commands","line_end":117,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `js-profile-react.md` | MEDIUM | React DevTools profiling |","category":"external_commands","line_end":118,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `js-measure-fps.md` | HIGH | FPS monitoring and measurement |","category":"external_commands","line_end":119,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `js-memory-leaks.md` | MEDIUM | JS memory leak hunting |","category":"external_commands","line_end":120,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `js-atomic-state.md` | HIGH | Jotai/Zustand patterns |","category":"external_commands","line_end":121,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `js-concurrent-react.md` | HIGH | useDeferredValue, useTransition |","category":"external_commands","line_end":122,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `js-react-compiler.md` | HIGH | Automatic memoization |","category":"external_commands","line_end":123,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `js-animations-reanimated.md` | MEDIUM | Reanimated worklets |","category":"external_commands","line_end":124,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `js-uncontrolled-components.md` | HIGH | TextInput optimization |","category":"external_commands","line_end":126,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### Native (`native-*`)","category":"external_commands","line_end":130,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-turbo-modules.md` | HIGH | Building fast native modules |","category":"external_commands","line_end":131,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-sdks-over-polyfills.md` | HIGH | Native vs JS libraries |","category":"external_commands","line_end":132,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-measure-tti.md` | HIGH | TTI measurement setup |","category":"external_commands","line_end":133,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-threading-model.md` | HIGH | Turbo Module threads |","category":"external_commands","line_end":134,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-profiling.md` | MEDIUM | Xcode/Android Studio profiling |","category":"external_commands","line_end":135,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-platform-setup.md` | MEDIUM | iOS/Android tooling guide |","category":"external_commands","line_end":136,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-view-flattening.md` | MEDIUM | View hierarchy debugging |","category":"external_commands","line_end":137,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-memory-patterns.md` | MEDIUM | C++/Swift/Kotlin memory |","category":"external_commands","line_end":138,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-memory-leaks.md` | MEDIUM | Native memory leak hunting |","category":"external_commands","line_end":139,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `native-android-16kb-alignment.md` | CRITICAL | Third-party library alignment for Google Play |","category":"external_commands","line_end":141,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### Bundling (`bundle-*`)","category":"external_commands","line_end":145,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `bundle-barrel-exports.md` | CRITICAL | Avoid barrel imports |","category":"external_commands","line_end":146,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `bundle-analyze-js.md` | CRITICAL | JS bundle visualization |","category":"external_commands","line_end":147,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `bundle-tree-shaking.md` | HIGH | Dead code elimination |","category":"external_commands","line_end":148,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `bundle-analyze-app.md` | HIGH | App size analysis |","category":"external_commands","line_end":149,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `bundle-r8-android.md` | HIGH | Android code shrinking |","category":"external_commands","line_end":150,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `bundle-hermes-mmap.md` | HIGH | Disable bundle compression |","category":"external_commands","line_end":151,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `bundle-native-assets.md` | HIGH | Asset catalog setup |","category":"external_commands","line_end":152,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `bundle-library-size.md` | MEDIUM | Evaluate dependencies |","category":"external_commands","line_end":153,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `bundle-code-splitting.md` | MEDIUM | Re.Pack code splitting |","category":"external_commands","line_end":157,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":165,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":171,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| App feels slow/janky | `js-measure-fps.md` → `js-profile-react.md` |","category":"external_commands","line_end":171,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Too many re-renders | `js-profile-react.md` → `js-react-compiler.md` |","category":"external_commands","line_end":172,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Slow startup (TTI) | `native-measure-tti.md` → `bundle-analyze-js.md` |","category":"external_commands","line_end":173,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Large app size | `bundle-analyze-app.md` → `bundle-r8-android.md` |","category":"external_commands","line_end":174,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Memory growing | `js-memory-leaks.md` or `native-memory-leaks.md` |","category":"external_commands","line_end":175,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Animation drops frames | `js-animations-reanimated.md` |","category":"external_commands","line_end":177,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| List scroll jank | `js-lists-flatlist-flashlist.md` |","category":"external_commands","line_end":178,"severity":"medium","line_start":177},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| TextInput lag | `js-uncontrolled-components.md` |","category":"external_commands","line_end":179,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Native module slow | `native-turbo-modules.md` → `native-threading-model.md` |","category":"external_commands","line_end":179,"severity":"medium","line_start":179},{"id":"filesystem:SKILL.md:93:memory-mapped-file-access","file":"SKILL.md","pattern":"Memory-mapped file access","snippet":"- Disable JS bundle compression on Android (enables Hermes mmap)","category":"filesystem","line_end":93,"severity":"high","line_start":93},{"id":"filesystem:SKILL.md:150:memory-mapped-file-access","file":"SKILL.md","pattern":"Memory-mapped file access","snippet":"| `bundle-hermes-mmap.md` | HIGH | Disable bundle compression |","category":"filesystem","line_end":150,"severity":"high","line_start":150},{"id":"blocker:SKILL.md:18:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Each reference file follows a hybrid format for fast lookup and deep understanding:","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:SKILL.md:81:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid barrel imports (import directly from source)","category":"blocker","line_end":81,"severity":"low","line_start":81},{"id":"blocker:SKILL.md:84:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Enable R8 for Android native code shrinking","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"blocker:SKILL.md:93:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Disable JS bundle compression on Android (enables Hermes mmap)","category":"blocker","line_end":93,"severity":"low","line_start":93},{"id":"blocker:SKILL.md:101:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Android: Android Studio → CPU Profiler","category":"blocker","line_end":101,"severity":"low","line_start":101},{"id":"blocker:SKILL.md:134:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| `native-profiling.md` | MEDIUM | Xcode/Android Studio profiling |","category":"blocker","line_end":134,"severity":"low","line_start":134},{"id":"blocker:SKILL.md:135:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| `native-platform-setup.md` | MEDIUM | iOS/Android tooling guide |","category":"blocker","line_end":135,"severity":"low","line_start":135},{"id":"blocker:SKILL.md:145:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| `bundle-barrel-exports.md` | CRITICAL | Avoid barrel imports |","category":"blocker","line_end":145,"severity":"low","line_start":145},{"id":"blocker:SKILL.md:149:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| `bundle-r8-android.md` | HIGH | Android code shrinking |","category":"blocker","line_end":149,"severity":"low","line_start":149},{"id":"metadata:references/images/expo-atlas-treemap.png:1:unscanned-file-binary-manual-review-required","file":"references/images/expo-atlas-treemap.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/xcode-instruments-templates.png:1:unscanned-file-binary-manual-review-required","file":"references/images/xcode-instruments-templates.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/tti-warm-start-diagram.png:1:unscanned-file-binary-manual-review-required","file":"references/images/tti-warm-start-diagram.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/devtools-flamegraph.png:1:unscanned-file-binary-manual-review-required","file":"references/images/devtools-flamegraph.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/fps-drop-graph.png:1:unscanned-file-binary-manual-review-required","file":"references/images/fps-drop-graph.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/view-hierarchy-flattening.png:1:unscanned-file-binary-manual-review-required","file":"references/images/view-hierarchy-flattening.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/memory-heap-snapshot.png:1:unscanned-file-binary-manual-review-required","file":"references/images/memory-heap-snapshot.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/flashlight-flatlist-vs-flashlist.png:1:unscanned-file-binary-manual-review-required","file":"references/images/flashlight-flatlist-vs-flashlist.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/controlled-textinput-pingpong.png:1:unscanned-file-binary-manual-review-required","file":"references/images/controlled-textinput-pingpong.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/bundle-treemap-source-map-explorer.png:1:unscanned-file-binary-manual-review-required","file":"references/images/bundle-treemap-source-map-explorer.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/xcode-thread-view.png:1:unscanned-file-binary-manual-review-required","file":"references/images/xcode-thread-view.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/emerge-xray-ios.png:1:unscanned-file-binary-manual-review-required","file":"references/images/emerge-xray-ios.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1}],"finding_verdicts":[{"id":"blocker:references/bundle-analyze-app.md:9:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:14:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:15:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:73:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:161:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:189:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:190:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:209:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"env_access:references/bundle-analyze-js.md:158:environment-variable-access-dot-notation","reason":"The snippet checks process.env.RSDOCTOR as a local build-analysis feature flag. It does not read secrets or transmit environment data.","verdict":"false_positive","confidence":0.93},{"id":"env_access:references/bundle-analyze-js.md:158:environment-variable-object","reason":"The snippet checks process.env.RSDOCTOR as a local build-analysis feature flag. It does not read secrets or transmit environment data.","verdict":"false_positive","confidence":0.93},{"id":"sensitive:references/bundle-analyze-js.md:158:environment-file-access","reason":"The process.env reference is a boolean tool toggle for Rsdoctor. No credential value is accessed, logged, or sent anywhere.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/bundle-analyze-js.md:140:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-js.md:239:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-js.md:243:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/bundle-barrel-exports.md:219:path-traversal-sequence","reason":"The snippet is a normal relative TypeScript import from a neighboring components directory. It is not filesystem traversal over user-controlled paths.","verdict":"false_positive","confidence":0.95},{"id":"sensitive:references/bundle-barrel-exports.md:138:environment-file-access","reason":"The .env snippet documents public Expo tree-shaking flags. It does not request secrets, tokens, or private configuration values.","verdict":"false_positive","confidence":0.91},{"id":"blocker:references/bundle-barrel-exports.md:2:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-barrel-exports.md:7:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"scripts:references/bundle-code-splitting.md:23:dynamic-import-expression","reason":"The snippet is a static React Native import example or an optimization warning. It does not execute user-controlled code inside the skill.","verdict":"false_positive","confidence":0.9},{"id":"scripts:references/bundle-code-splitting.md:66:dynamic-import-expression","reason":"The snippet is a static React Native import example or an optimization warning. It does not execute user-controlled code inside the skill.","verdict":"false_positive","confidence":0.9},{"id":"scripts:references/bundle-code-splitting.md:68:dynamic-import-expression","reason":"The snippet is a static React Native import example or an optimization warning. It does not execute user-controlled code inside the skill.","verdict":"false_positive","confidence":0.9},{"id":"scripts:references/bundle-code-splitting.md:118:dynamic-import-expression","reason":"The snippet is a static React Native import example or an optimization warning. It does not execute user-controlled code inside the skill.","verdict":"false_positive","confidence":0.9},{"id":"scripts:references/bundle-code-splitting.md:148:dynamic-import-expression","reason":"The example imports a module from a remote-app namespace in a remote code loading guide. This can execute code supplied outside the shipped app bundle.","verdict":"confirmed","severity":"medium","confidence":0.66},{"id":"external_commands:references/bundle-code-splitting.md:95:ruby-shell-backtick-execution","reason":"The scanner matched JavaScript template literals or console logging. These snippets are not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:references/bundle-code-splitting.md:170:ruby-shell-backtick-execution","reason":"The scanner matched JavaScript template literals or console logging. These snippets are not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:references/bundle-code-splitting.md:175:ruby-shell-backtick-execution","reason":"The scanner matched JavaScript template literals or console logging. These snippets are not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:references/bundle-code-splitting.md:201:ruby-shell-backtick-execution","reason":"The scanner matched JavaScript template literals or console logging. These snippets are not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:references/bundle-code-splitting.md:205:ruby-shell-backtick-execution","reason":"The scanner matched JavaScript template literals or console logging. These snippets are not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:references/bundle-code-splitting.md:209:ruby-shell-backtick-execution","reason":"The scanner matched JavaScript template literals or console logging. These snippets are not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.94},{"id":"network:references/bundle-code-splitting.md:95:hardcoded-url","reason":"The hardcoded URL is part of production remote chunk loading. Without integrity controls, it can fetch executable app code from a CDN.","verdict":"confirmed","severity":"medium","confidence":0.68},{"id":"network:references/bundle-code-splitting.md:170:hardcoded-url","reason":"The hardcoded URL is part of production remote chunk loading. Without integrity controls, it can fetch executable app code from a CDN.","verdict":"confirmed","severity":"medium","confidence":0.68},{"id":"filesystem:references/bundle-code-splitting.md:184:memory-mapped-file-access","reason":"The mmap text describes Hermes startup behavior and Android packaging guidance. The skill does not invoke memory mapping or access files directly.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:references/bundle-code-splitting.md:191:memory-mapped-file-access","reason":"The mmap text describes Hermes startup behavior and Android packaging guidance. The skill does not invoke memory mapping or access files directly.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:references/bundle-hermes-mmap.md:4:memory-mapped-file-access","reason":"The mmap text describes Hermes startup behavior and Android packaging guidance. The skill does not invoke memory mapping or access files directly.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:references/bundle-hermes-mmap.md:35:memory-mapped-file-access","reason":"The mmap text describes Hermes startup behavior and Android packaging guidance. The skill does not invoke memory mapping or access files directly.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:references/bundle-hermes-mmap.md:135:memory-mapped-file-access","reason":"The mmap text describes Hermes startup behavior and Android packaging guidance. The skill does not invoke memory mapping or access files directly.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/bundle-hermes-mmap.md:9:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:15:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:26:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:33:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:48:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:60:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:70:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:93:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"scripts:references/bundle-library-size.md:165:dynamic-import-expression","reason":"The snippet is a static React Native import example or an optimization warning. It does not execute user-controlled code inside the skill.","verdict":"false_positive","confidence":0.9},{"id":"network:references/bundle-library-size.md:15:hardcoded-url","reason":"The URL is a documentation reference for a public analysis tool or package page. It is not used for data exfiltration or covert network activity.","verdict":"false_positive","confidence":0.9},{"id":"network:references/bundle-library-size.md:103:hardcoded-url","reason":"The URL is a documentation reference for a public analysis tool or package page. It is not used for data exfiltration or covert network activity.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-native-assets.md:47:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-native-assets.md:53:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-native-assets.md:214:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:9:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:17:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:29:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:59:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:96:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"scripts:references/bundle-tree-shaking.md:207:dynamic-require-with-variable","reason":"The snippet is a static React Native import example or an optimization warning. It does not execute user-controlled code inside the skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:references/bundle-tree-shaking.md:27:ruby-shell-backtick-execution","reason":"The snippet is a JavaScript config comment that names a Babel option. It does not execute a command or interpolate shell input.","verdict":"false_positive","confidence":0.93},{"id":"sensitive:references/bundle-tree-shaking.md:14:environment-file-access","reason":"The .env snippet documents public Expo tree-shaking flags. It does not request secrets, tokens, or private configuration values.","verdict":"false_positive","confidence":0.91},{"id":"sensitive:references/bundle-tree-shaking.md:74:environment-file-access","reason":"The .env snippet documents public Expo tree-shaking flags. It does not request secrets, tokens, or private configuration values.","verdict":"false_positive","confidence":0.91},{"id":"blocker:references/bundle-tree-shaking.md:118:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-tree-shaking.md:122:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-tree-shaking.md:205:network-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-animations-reanimated.md:266:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-atomic-state.md:32:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-atomic-state.md:111:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-atomic-state.md:116:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-atomic-state.md:139:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-concurrent-react.md:13:keylogger-keywords","reason":"The word keystroke describes TextInput render lag in a Concurrent React example. The snippet does not capture, store, or transmit key input.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/js-concurrent-react.md:164:keylogger-keywords","reason":"The word keystroke describes TextInput render lag in a Concurrent React example. The snippet does not capture, store, or transmit key input.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/js-lists-flatlist-flashlist.md:202:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"network:references/js-measure-fps.md:18:hardcoded-url","reason":"The URL is used as the source for a curl-to-bash installer. The external network dependency becomes code execution if the endpoint is compromised.","verdict":"confirmed","severity":"high","confidence":0.84},{"id":"network:references/js-measure-fps.md:76:hardcoded-url","reason":"The URL is used as the source for a curl-to-bash installer. The external network dependency becomes code execution if the endpoint is compromised.","verdict":"confirmed","severity":"high","confidence":0.84},{"id":"blocker:references/js-measure-fps.md:18:pipe-to-shell-pattern","reason":"The snippet pipes a remote installer from get.flashlight.dev directly into bash. This executes unaudited network content on the user machine.","verdict":"confirmed","severity":"critical","confidence":0.92},{"id":"blocker:references/js-measure-fps.md:76:pipe-to-shell-pattern","reason":"The snippet pipes a remote installer from get.flashlight.dev directly into bash. This executes unaudited network content on the user machine.","verdict":"confirmed","severity":"critical","confidence":0.92},{"id":"blocker:references/js-measure-fps.md:32:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-measure-fps.md:42:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-measure-fps.md:60:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-profile-react.md:71:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-profile-react.md:73:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-profile-react.md:155:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/native-android-16kb-alignment.md:80:standard-device-file-access","reason":"The command searches node_modules inside the local project to identify Android libraries. It does not access sensitive device files or exfiltrate results.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:references/native-android-16kb-alignment.md:83:standard-device-file-access","reason":"The command searches node_modules inside the local project to identify Android libraries. It does not access sensitive device files or exfiltrate results.","verdict":"false_positive","confidence":0.84},{"id":"blocker:references/native-android-16kb-alignment.md:2:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:7:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:15:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:47:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:67:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:70:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:83:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/native-measure-tti.md:262:memory-mapped-file-access","reason":"The mmap text describes Hermes startup behavior and Android packaging guidance. The skill does not invoke memory mapping or access files directly.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/native-measure-tti.md:91:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-measure-tti.md:229:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-measure-tti.md:262:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:9:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:18:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:70:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:76:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:83:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:112:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:140:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:159:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:193:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:200:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:43:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:62:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:66:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:76:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:84:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:143:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:9:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:17:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:22:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:39:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:81:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:85:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:94:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:119:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:122:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:145:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:162:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:172:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:173:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:180:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:185:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:201:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:9:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:18:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:29:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:76:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:137:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:138:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:139:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:143:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:160:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:63:network-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:13:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:34:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:46:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:47:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:51:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:105:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:119:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:133:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:221:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-turbo-modules.md:62:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-turbo-modules.md:249:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-view-flattening.md:38:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-view-flattening.md:100:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-view-flattening.md:102:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","reason":"The scanner matched Markdown backticks, table entries, or fenced examples in SKILL.md. There is no shell backtick operator or child process call.","verdict":"false_positive","confidence":0.92},{"id":"filesystem:SKILL.md:93:memory-mapped-file-access","reason":"The mmap text describes Hermes startup behavior and Android packaging guidance. The skill does not invoke memory mapping or access files directly.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:SKILL.md:150:memory-mapped-file-access","reason":"The mmap text describes Hermes startup behavior and Android packaging guidance. The skill does not invoke memory mapping or access files directly.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:18:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:81:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:84:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:93:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:101:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:134:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:135:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:145:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:149:system-reconnaissance","reason":"The snippet is React Native performance documentation, local build guidance, or profiler terminology. It does not perform autonomous reconnaissance or send host data anywhere.","verdict":"false_positive","confidence":0.9},{"id":"metadata:references/images/expo-atlas-treemap.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/xcode-instruments-templates.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/tti-warm-start-diagram.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/devtools-flamegraph.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/fps-drop-graph.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/view-hierarchy-flattening.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/memory-heap-snapshot.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/flashlight-flatlist-vs-flashlist.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/controlled-textinput-pingpong.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/bundle-treemap-source-map-explorer.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/xcode-thread-view.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86},{"id":"metadata:references/images/emerge-xray-ios.png:1:unscanned-file-binary-manual-review-required","reason":"Manual visual review and string inspection showed PNG screenshots or diagrams for performance documentation. No executable content or prompt-injection text was found.","verdict":"false_positive","confidence":0.86}],"semantic_findings":[{"title":"Remote Code Loading Lacks Integrity Guidance","severity":"high","locations":[{"file":"references/bundle-code-splitting.md","line_end":96,"line_start":86},{"file":"references/bundle-code-splitting.md","line_end":149,"line_start":141},{"file":"references/bundle-code-splitting.md","line_end":176,"line_start":166}],"confidence":0.86,"description":"references/bundle-code-splitting.md presents production CDN chunk loading and module federation without signing, integrity, or allowlist guidance. A compromised CDN or remote module could execute untrusted JavaScript inside the app.","confidence_reasoning":"The file is explicitly about remote code loading and shows CDN chunk resolution plus module federation. The risk is contextual because the guide lacks trust, signing, or integrity controls."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":3,"capabilityReviewCount":5,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}