{"data":{"skill":{"slug":"callstackincubator-react-native-best-practices","name":"react-native-best-practices","icon":"📦","repo":"https://github.com/callstackincubator/agent-skills/tree/main/skills/react-native-best-practices/","status":"approved","author":"callstackincubator","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"fe348bb3-67f0-477b-a397-23884274491d","skill_id":"83b02645-ff1b-4230-99b8-5ed263486fdc","version":4,"content_hash":"da90397b2a6284501c4967ceafff4a33","risk_level":"low","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Static analysis matched documentation text, markdown inline code, and React Native examples rather than executable skill behavior. I found no prompt-injection language, credential exfiltration intent, malicious command behavior, or unsafe remote-code instructions. Binary findings were manually identified as PNG documentation screenshots.","remediation":[],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"POWER.md","line_end":63,"line_start":63},{"file":"POWER.md","line_end":142,"line_start":142},{"file":"references/bundle-barrel-exports.md","line_end":221,"line_start":221},{"file":"references/bundle-code-splitting.md","line_end":214,"line_start":214},{"file":"references/bundle-code-splitting.md","line_end":221,"line_start":221},{"file":"references/bundle-hermes-mmap.md","line_end":4,"line_start":4},{"file":"references/bundle-hermes-mmap.md","line_end":35,"line_start":35},{"file":"references/bundle-hermes-mmap.md","line_end":135,"line_start":135},{"file":"references/native-android-16kb-alignment.md","line_end":81,"line_start":81},{"file":"references/native-android-16kb-alignment.md","line_end":84,"line_start":84},{"file":"references/native-measure-tti.md","line_end":221,"line_start":221},{"file":"references/native-platform-setup.md","line_end":112,"line_start":112},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":187,"line_start":187},{"file":"SKILL.md","line_end":234,"line_start":234}]},{"factor":"env_access","evidence":[{"file":"references/bundle-analyze-js.md","line_end":160,"line_start":160},{"file":"references/bundle-analyze-js.md","line_end":160,"line_start":160}]},{"factor":"scripts","evidence":[{"file":"references/bundle-code-splitting.md","line_end":23,"line_start":23},{"file":"references/bundle-code-splitting.md","line_end":72,"line_start":72},{"file":"references/bundle-code-splitting.md","line_end":74,"line_start":74},{"file":"references/bundle-code-splitting.md","line_end":164,"line_start":164},{"file":"references/bundle-code-splitting.md","line_end":194,"line_start":194},{"file":"references/bundle-tree-shaking.md","line_end":208,"line_start":208}]},{"factor":"external_commands","evidence":[{"file":"references/bundle-code-splitting.md","line_end":134,"line_start":115},{"file":"references/bundle-code-splitting.md","line_end":235,"line_start":231},{"file":"references/bundle-code-splitting.md","line_end":241,"line_start":235},{"file":"references/bundle-tree-shaking.md","line_end":36,"line_start":27},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":77,"line_start":69},{"file":"SKILL.md","line_end":79,"line_start":77},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":94,"line_start":89},{"file":"SKILL.md","line_end":103,"line_start":94},{"file":"SKILL.md","line_end":106,"line_start":103},{"file":"SKILL.md","line_end":114,"line_start":106},{"file":"SKILL.md","line_end":125,"line_start":114},{"file":"SKILL.md","line_end":148,"line_start":125},{"file":"SKILL.md","line_end":153,"line_start":148},{"file":"SKILL.md","line_end":163,"line_start":153},{"file":"SKILL.md","line_end":178,"line_start":163}]},{"factor":"network","evidence":[{"file":"references/bundle-library-size.md","line_end":15,"line_start":15},{"file":"references/bundle-library-size.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":83,"line_start":83}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/expo-atlas-treemap.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/view-hierarchy-flattening.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/bundle-treemap-source-map-explorer.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/memory-heap-snapshot.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/devtools-flamegraph.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/xcode-instruments-templates.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/fps-drop-graph.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/tti-warm-start-diagram.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/xcode-thread-view.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/emerge-xray-ios.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/controlled-textinput-pingpong.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"references/images/flashlight-flatlist-vs-flashlist.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."}],"dangerous_patterns":[],"files_scanned":32,"total_lines":6483,"audit_model":"codex","audited_at":"2026-07-08T03:13:36.487+00:00","created_at":"2026-07-08T04:36:14.198715+00:00","static_findings":[{"id":"filesystem:POWER.md:63:memory-mapped-file-access","file":"POWER.md","pattern":"Memory-mapped file access","snippet":"- **Optimizing Hermes bundle loading** → `references/bundle-hermes-mmap.md`","category":"filesystem","line_end":63,"severity":"high","line_start":63},{"id":"filesystem:POWER.md:142:memory-mapped-file-access","file":"POWER.md","pattern":"Memory-mapped file access","snippet":"- For React Native 0.78 and earlier, disable Android JS bundle compression to enable Hermes mmap","category":"filesystem","line_end":142,"severity":"high","line_start":142},{"id":"blocker:POWER.md:54:system-reconnaissance","file":"POWER.md","pattern":"System reconnaissance","snippet":"- **Fixing Android 16KB alignment** → `references/native-android-16kb-alignment.md`","category":"blocker","line_end":54,"severity":"low","line_start":54},{"id":"blocker:POWER.md:62:system-reconnaissance","file":"POWER.md","pattern":"System reconnaissance","snippet":"- **Android code shrinking** → `references/bundle-r8-android.md`","category":"blocker","line_end":62,"severity":"low","line_start":62},{"id":"blocker:POWER.md:132:system-reconnaissance","file":"POWER.md","pattern":"System reconnaissance","snippet":"- Avoid barrel imports (import directly from source)","category":"blocker","line_end":132,"severity":"low","line_start":132},{"id":"blocker:POWER.md:135:system-reconnaissance","file":"POWER.md","pattern":"System reconnaissance","snippet":"- Enable R8 for Android native code shrinking","category":"blocker","line_end":135,"severity":"low","line_start":135},{"id":"blocker:POWER.md:142:system-reconnaissance","file":"POWER.md","pattern":"System reconnaissance","snippet":"- For React Native 0.78 and earlier, disable Android JS bundle compression to enable Hermes mmap","category":"blocker","line_end":142,"severity":"low","line_start":142},{"id":"blocker:POWER.md:150:system-reconnaissance","file":"POWER.md","pattern":"System reconnaissance","snippet":"- Android: Android Studio → CPU Profiler","category":"blocker","line_end":150,"severity":"low","line_start":150},{"id":"blocker:references/bundle-analyze-app.md:9:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"Measure iOS and Android app download/install sizes using Ruler, App Store Connect, and Emerge Tools.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/bundle-analyze-app.md:14:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"# Android (Ruler)","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:references/bundle-analyze-app.md:15:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew analyzeReleaseBundle","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:references/bundle-analyze-app.md:73:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"cd android","category":"blocker","line_end":74,"severity":"low","line_start":73},{"id":"blocker:references/bundle-analyze-app.md:158:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"| Ruler | Android | High | Yes (Gradle) |","category":"blocker","line_end":158,"severity":"low","line_start":158},{"id":"blocker:references/bundle-analyze-app.md:186:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"# Android release bundle size","category":"blocker","line_end":186,"severity":"low","line_start":186},{"id":"blocker:references/bundle-analyze-app.md:187:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew bundleRelease","category":"blocker","line_end":187,"severity":"low","line_start":187},{"id":"blocker:references/bundle-analyze-app.md:206:system-reconnaissance","file":"references/bundle-analyze-app.md","pattern":"System reconnaissance","snippet":"- [bundle-r8-android.md](./bundle-r8-android.md) - Reduce Android size","category":"blocker","line_end":206,"severity":"low","line_start":206},{"id":"env_access:references/bundle-analyze-js.md:160:environment-variable-access-dot-notation","file":"references/bundle-analyze-js.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.RSDOCTOR && new RsdoctorRspackPlugin(),","category":"env_access","line_end":160,"severity":"low","line_start":160},{"id":"env_access:references/bundle-analyze-js.md:160:environment-variable-object","file":"references/bundle-analyze-js.md","pattern":"Environment variable object","snippet":"process.env.RSDOCTOR && new RsdoctorRspackPlugin(),","category":"env_access","line_end":160,"severity":"low","line_start":160},{"id":"sensitive:references/bundle-analyze-js.md:160:environment-file-access","file":"references/bundle-analyze-js.md","pattern":"Environment file access","snippet":"process.env.RSDOCTOR && new RsdoctorRspackPlugin(),","category":"sensitive","line_end":160,"severity":"high","line_start":160},{"id":"blocker:references/bundle-analyze-js.md:142:system-reconnaissance","file":"references/bundle-analyze-js.md","pattern":"System reconnaissance","snippet":"--platform android \\","category":"blocker","line_end":142,"severity":"low","line_start":142},{"id":"blocker:references/bundle-analyze-js.md:241:system-reconnaissance","file":"references/bundle-analyze-js.md","pattern":"System reconnaissance","snippet":"# Android bundle analysis","category":"blocker","line_end":241,"severity":"low","line_start":241},{"id":"blocker:references/bundle-analyze-js.md:245:system-reconnaissance","file":"references/bundle-analyze-js.md","pattern":"System reconnaissance","snippet":"--platform android \\","category":"blocker","line_end":245,"severity":"low","line_start":245},{"id":"filesystem:references/bundle-barrel-exports.md:221:path-traversal-sequence","file":"references/bundle-barrel-exports.md","pattern":"Path traversal sequence","snippet":"import Button from '../components/Button';","category":"filesystem","line_end":221,"severity":"high","line_start":221},{"id":"sensitive:references/bundle-barrel-exports.md:138:environment-file-access","file":"references/bundle-barrel-exports.md","pattern":"Environment file access","snippet":"# .env","category":"sensitive","line_end":138,"severity":"high","line_start":138},{"id":"blocker:references/bundle-barrel-exports.md:2:system-reconnaissance","file":"references/bundle-barrel-exports.md","pattern":"System reconnaissance","snippet":"title: Avoid Barrel Exports","category":"blocker","line_end":2,"severity":"low","line_start":2},{"id":"blocker:references/bundle-barrel-exports.md:7:system-reconnaissance","file":"references/bundle-barrel-exports.md","pattern":"System reconnaissance","snippet":"# Skill: Avoid Barrel Exports","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"scripts:references/bundle-code-splitting.md:23:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"import(/* webpackChunkName: \"settings\" */ './screens/SettingsScreen')","category":"scripts","line_end":23,"severity":"medium","line_start":23},{"id":"scripts:references/bundle-code-splitting.md:72:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"// AFTER: Dynamic import (creates split point)","category":"scripts","line_end":72,"severity":"medium","line_start":72},{"id":"scripts:references/bundle-code-splitting.md:74:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"import(/* webpackChunkName: \"settings\" */ './screens/SettingsScreen')","category":"scripts","line_end":74,"severity":"medium","line_start":74},{"id":"scripts:references/bundle-code-splitting.md:164:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"import(/* webpackChunkName: \"heavy-feature\" */ './HeavyFeature')","category":"scripts","line_end":164,"severity":"medium","line_start":164},{"id":"scripts:references/bundle-code-splitting.md:194:dynamic-import-expression","file":"references/bundle-code-splitting.md","pattern":"Dynamic import() expression","snippet":"import('remote-app/Module')","category":"scripts","line_end":194,"severity":"medium","line_start":194},{"id":"external_commands:references/bundle-code-splitting.md:115:ruby-shell-backtick-execution","file":"references/bundle-code-splitting.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Unknown chunk: ${scriptId}`);","category":"external_commands","line_end":134,"severity":"medium","line_start":115},{"id":"external_commands:references/bundle-code-splitting.md:231:ruby-shell-backtick-execution","file":"references/bundle-code-splitting.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Loading: ${script.scriptId}`);","category":"external_commands","line_end":235,"severity":"medium","line_start":231},{"id":"external_commands:references/bundle-code-splitting.md:235:ruby-shell-backtick-execution","file":"references/bundle-code-splitting.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Loaded: ${script.scriptId}`);","category":"external_commands","line_end":241,"severity":"medium","line_start":235},{"id":"filesystem:references/bundle-code-splitting.md:214:memory-mapped-file-access","file":"references/bundle-code-splitting.md","pattern":"Memory-mapped file access","snippet":"| Using Hermes | mmap already efficient |","category":"filesystem","line_end":214,"severity":"high","line_start":214},{"id":"filesystem:references/bundle-code-splitting.md:221:memory-mapped-file-access","file":"references/bundle-code-splitting.md","pattern":"Memory-mapped file access","snippet":"Hermes reads bytecode lazily via mmap:","category":"filesystem","line_end":221,"severity":"high","line_start":221},{"id":"blocker:references/bundle-code-splitting.md:129:system-reconnaissance","file":"references/bundle-code-splitting.md","pattern":"System reconnaissance","snippet":"// Do not accept hostnames, paths, or script IDs from runtime input.","category":"blocker","line_end":129,"severity":"low","line_start":129},{"id":"filesystem:references/bundle-hermes-mmap.md:4:memory-mapped-file-access","file":"references/bundle-hermes-mmap.md","pattern":"Memory-mapped file access","snippet":"tags: android, hermes, mmap, tti, startup","category":"filesystem","line_end":4,"severity":"high","line_start":4},{"id":"filesystem:references/bundle-hermes-mmap.md:35:memory-mapped-file-access","file":"references/bundle-hermes-mmap.md","pattern":"Memory-mapped file access","snippet":"**Problem**: Compressed files can't be memory-mapped (mmap).","category":"filesystem","line_end":35,"severity":"high","line_start":35},{"id":"filesystem:references/bundle-hermes-mmap.md:135:memory-mapped-file-access","file":"references/bundle-hermes-mmap.md","pattern":"Memory-mapped file access","snippet":"If you have other files that benefit from mmap:","category":"filesystem","line_end":135,"severity":"high","line_start":135},{"id":"blocker:references/bundle-hermes-mmap.md:9:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"Disable Android JS bundle compression to enable Hermes memory mapping for faster startup on React Na","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/bundle-hermes-mmap.md:15:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:references/bundle-hermes-mmap.md:22:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"**Note**: React Native 0.79+ defaults to uncompressed Android JS bundles. Prefer checking/toggling `","category":"blocker","line_end":22,"severity":"low","line_start":22},{"id":"blocker:references/bundle-hermes-mmap.md:26:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"- Android app using Hermes","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:references/bundle-hermes-mmap.md:33:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"Android compresses most files in APK/AAB by default, including `index.android.bundle`.","category":"blocker","line_end":33,"severity":"low","line_start":33},{"id":"blocker:references/bundle-hermes-mmap.md:48:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"1. Android decompresses entire bundle","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:references/bundle-hermes-mmap.md:60:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":60,"severity":"low","line_start":60},{"id":"blocker:references/bundle-hermes-mmap.md:70:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":70,"severity":"low","line_start":70},{"id":"blocker:references/bundle-hermes-mmap.md:93:system-reconnaissance","file":"references/bundle-hermes-mmap.md","pattern":"System reconnaissance","snippet":"cd android","category":"blocker","line_end":94,"severity":"low","line_start":93},{"id":"network:references/bundle-library-size.md:15:hardcoded-url","file":"references/bundle-library-size.md","pattern":"Hardcoded URL","snippet":"# Visit: https://bundlephobia.com/package/[package-name]","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:references/bundle-library-size.md:104:hardcoded-url","file":"references/bundle-library-size.md","pattern":"Hardcoded URL","snippet":"https://bundlephobia.com/package/[package-name]","category":"network","line_end":104,"severity":"low","line_start":104},{"id":"blocker:references/bundle-native-assets.md:47:system-reconnaissance","file":"references/bundle-native-assets.md","pattern":"System reconnaissance","snippet":"Android handles this automatically.","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:references/bundle-native-assets.md:53:system-reconnaissance","file":"references/bundle-native-assets.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew bundleRelease","category":"blocker","line_end":53,"severity":"low","line_start":53},{"id":"blocker:references/bundle-native-assets.md:208:system-reconnaissance","file":"references/bundle-native-assets.md","pattern":"System reconnaissance","snippet":"- [bundle-r8-android.md](./bundle-r8-android.md) - Android code optimization","category":"blocker","line_end":208,"severity":"low","line_start":208},{"id":"blocker:references/bundle-r8-android.md:9:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"Enable R8 for Android to shrink, optimize, and obfuscate native code.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/bundle-r8-android.md:17:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":17,"severity":"low","line_start":17},{"id":"blocker:references/bundle-r8-android.md:29:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"- Android app size too large","category":"blocker","line_end":29,"severity":"low","line_start":29},{"id":"blocker:references/bundle-r8-android.md:59:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"android {","category":"blocker","line_end":59,"severity":"low","line_start":59},{"id":"blocker:references/bundle-r8-android.md:98:system-reconnaissance","file":"references/bundle-r8-android.md","pattern":"System reconnaissance","snippet":"cd android","category":"blocker","line_end":99,"severity":"low","line_start":98},{"id":"scripts:references/bundle-tree-shaking.md:208:dynamic-require-with-variable","file":"references/bundle-tree-shaking.md","pattern":"Dynamic require with variable","snippet":"- **Dynamic imports**: `require(variable)` prevents analysis","category":"scripts","line_end":208,"severity":"medium","line_start":208},{"id":"external_commands:references/bundle-tree-shaking.md:27:ruby-shell-backtick-execution","file":"references/bundle-tree-shaking.md","pattern":"Ruby/shell backtick execution","snippet":"// babel.config.js (non-Expo projects must set `disableImportExportTransform`)","category":"external_commands","line_end":36,"severity":"medium","line_start":27},{"id":"sensitive:references/bundle-tree-shaking.md:14:environment-file-access","file":"references/bundle-tree-shaking.md","pattern":"Environment file access","snippet":"# .env (Expo SDK 52+)","category":"sensitive","line_end":14,"severity":"high","line_start":14},{"id":"sensitive:references/bundle-tree-shaking.md:75:environment-file-access","file":"references/bundle-tree-shaking.md","pattern":"Environment file access","snippet":"Create/edit `.env`:","category":"sensitive","line_end":75,"severity":"high","line_start":75},{"id":"blocker:references/bundle-tree-shaking.md:119:system-reconnaissance","file":"references/bundle-tree-shaking.md","pattern":"System reconnaissance","snippet":"// Removed from Android bundle","category":"blocker","line_end":119,"severity":"low","line_start":119},{"id":"blocker:references/bundle-tree-shaking.md:123:system-reconnaissance","file":"references/bundle-tree-shaking.md","pattern":"System reconnaissance","snippet":"// Removed from Android bundle","category":"blocker","line_end":123,"severity":"low","line_start":123},{"id":"blocker:references/bundle-tree-shaking.md:206:network-reconnaissance","file":"references/bundle-tree-shaking.md","pattern":"Network reconnaissance","snippet":"- **CommonJS modules**: Need ESM for full effectiveness","category":"blocker","line_end":207,"severity":"low","line_start":206},{"id":"blocker:references/js-animations-reanimated.md:144:system-reconnaissance","file":"references/js-animations-reanimated.md","pattern":"System reconnaissance","snippet":"Avoid calling `scheduleOnRN` from `useAnimatedStyle`; style worklets can evaluate more often than an","category":"blocker","line_end":144,"severity":"low","line_start":144},{"id":"blocker:references/js-animations-reanimated.md:224:system-reconnaissance","file":"references/js-animations-reanimated.md","pattern":"System reconnaissance","snippet":"> **Can't upgrade to v4?** If your project is blocked from migrating to New Architecture (e.g., inco","category":"blocker","line_end":224,"severity":"low","line_start":224},{"id":"blocker:references/js-atomic-state.md:32:system-reconnaissance","file":"references/js-atomic-state.md","pattern":"System reconnaissance","snippet":"- Want to avoid manual `useMemo`/`useCallback` everywhere","category":"blocker","line_end":32,"severity":"low","line_start":32},{"id":"blocker:references/js-atomic-state.md:94:system-reconnaissance","file":"references/js-atomic-state.md","pattern":"System reconnaissance","snippet":"const TodoItem = ({ id }) => {","category":"blocker","line_end":94,"severity":"low","line_start":94},{"id":"blocker:references/js-atomic-state.md:99:system-reconnaissance","file":"references/js-atomic-state.md","pattern":"System reconnaissance","snippet":"prev.map((t) => t.id === id ? { ...t, completed: !t.completed } : t)","category":"blocker","line_end":99,"severity":"low","line_start":99},{"id":"blocker:references/js-atomic-state.md:122:system-reconnaissance","file":"references/js-atomic-state.md","pattern":"System reconnaissance","snippet":"t.id === id ? { ...t, completed: !t.completed } : t","category":"blocker","line_end":122,"severity":"low","line_start":122},{"id":"blocker:references/js-atomic-state.md:188:system-reconnaissance","file":"references/js-atomic-state.md","pattern":"System reconnaissance","snippet":"- [js-bottomsheet.md](./js-bottomsheet.md) - Avoid context-driven bottom sheet subtree re-renders","category":"blocker","line_end":188,"severity":"low","line_start":188},{"id":"blocker:references/js-bottomsheet.md:78:system-reconnaissance","file":"references/js-bottomsheet.md","pattern":"System reconnaissance","snippet":"Avoid React state for gesture-driven visual state. Update a shared value and consume it via `useAnim","category":"blocker","line_end":78,"severity":"low","line_start":78},{"id":"blocker:references/js-concurrent-react.md:13:keylogger-keywords","file":"references/js-concurrent-react.md","pattern":"Keylogger keywords","snippet":"**Incorrect (blocks input on every keystroke):**","category":"blocker","line_end":13,"severity":"critical","line_start":13},{"id":"blocker:references/js-concurrent-react.md:166:keylogger-keywords","file":"references/js-concurrent-react.md","pattern":"Keylogger keywords","snippet":"<SlowComponent query={query} /> {/* Blocks every keystroke */}","category":"blocker","line_end":166,"severity":"critical","line_start":166},{"id":"blocker:references/js-lists-flatlist-flashlist.md:197:system-reconnaissance","file":"references/js-lists-flatlist-flashlist.md","pattern":"System reconnaissance","snippet":"// Avoid re-renders","category":"blocker","line_end":197,"severity":"low","line_start":197},{"id":"blocker:references/js-measure-fps.md:32:system-reconnaissance","file":"references/js-measure-fps.md","pattern":"System reconnaissance","snippet":"- For Flashlight: Android device (iOS not supported)","category":"blocker","line_end":32,"severity":"low","line_start":32},{"id":"blocker:references/js-measure-fps.md:42:system-reconnaissance","file":"references/js-measure-fps.md","pattern":"System reconnaissance","snippet":"- Android Emulator: `Cmd + M` (Mac) / `Ctrl + M` (Windows)","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:references/js-measure-fps.md:60:system-reconnaissance","file":"references/js-measure-fps.md","pattern":"System reconnaissance","snippet":"> Android only. Provides detailed reports and JSON export.","category":"blocker","line_end":60,"severity":"low","line_start":60},{"id":"blocker:references/js-profile-react.md:130:system-reconnaissance","file":"references/js-profile-react.md","pattern":"System reconnaissance","snippet":"- **Ignoring \"Why did this render?\"**: This tells you exactly what to fix","category":"blocker","line_end":130,"severity":"low","line_start":130},{"id":"blocker:references/js-uncontrolled-components.md:9:keylogger-keywords","file":"references/js-uncontrolled-components.md","pattern":"Keylogger keywords","snippet":"Fix TextInput synchronization and flickering issues by using the uncontrolled component pattern wher","category":"blocker","line_end":9,"severity":"critical","line_start":9},{"id":"blocker:references/js-uncontrolled-components.md:31:keylogger-keywords","file":"references/js-uncontrolled-components.md","pattern":"Keylogger keywords","snippet":"- React does not need to transform, mask, validate, or own the value on every keystroke","category":"blocker","line_end":31,"severity":"critical","line_start":31},{"id":"blocker:references/js-uncontrolled-components.md:54:keylogger-keywords","file":"references/js-uncontrolled-components.md","pattern":"Keylogger keywords","snippet":"Use uncontrolled TextInput primarily as a responsiveness or legacy-architecture escape hatch. Keep c","category":"blocker","line_end":54,"severity":"critical","line_start":54},{"id":"blocker:references/js-uncontrolled-components.md:30:network-reconnaissance","file":"references/js-uncontrolled-components.md","pattern":"Network reconnaissance","snippet":"- Need maximum input responsiveness","category":"blocker","line_end":31,"severity":"low","line_start":30},{"id":"filesystem:references/native-android-16kb-alignment.md:81:standard-device-file-access","file":"references/native-android-16kb-alignment.md","pattern":"Standard device file access","snippet":"find node_modules -name \"libfoo.so\" 2>/dev/null","category":"filesystem","line_end":81,"severity":"low","line_start":81},{"id":"filesystem:references/native-android-16kb-alignment.md:84:standard-device-file-access","file":"references/native-android-16kb-alignment.md","pattern":"Standard device file access","snippet":"grep -r \"foo\" node_modules/*/android --include=\"*.gradle\" 2>/dev/null","category":"filesystem","line_end":84,"severity":"low","line_start":84},{"id":"blocker:references/native-android-16kb-alignment.md:2:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"title: Android 16 KB Page Size Alignment","category":"blocker","line_end":2,"severity":"low","line_start":2},{"id":"blocker:references/native-android-16kb-alignment.md:7:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"# Android 16 KB page size alignment","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"blocker:references/native-android-16kb-alignment.md:15:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"| Google Play requirement | Apps and updates targeting Android 15+ must support 16 KB page sizes on ","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:references/native-android-16kb-alignment.md:47:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"* Investigating crashes on Android 15+ devices with 16 KB page size","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:references/native-android-16kb-alignment.md:68:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"For runtime testing, use the [16KB Android Emulator image][] or enable","category":"blocker","line_end":68,"severity":"low","line_start":68},{"id":"blocker:references/native-android-16kb-alignment.md:71:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"[16KB Android Emulator image]: https://developer.android.com/guide/practices/page-sizes#set-up-the-a","category":"blocker","line_end":71,"severity":"low","line_start":71},{"id":"blocker:references/native-android-16kb-alignment.md:84:system-reconnaissance","file":"references/native-android-16kb-alignment.md","pattern":"System reconnaissance","snippet":"grep -r \"foo\" node_modules/*/android --include=\"*.gradle\" 2>/dev/null","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"filesystem:references/native-measure-tti.md:221:memory-mapped-file-access","file":"references/native-measure-tti.md","pattern":"Memory-mapped file access","snippet":"- [bundle-hermes-mmap.md](./bundle-hermes-mmap.md) - Improve Android TTI","category":"filesystem","line_end":221,"severity":"high","line_start":221},{"id":"blocker:references/native-measure-tti.md:75:system-reconnaissance","file":"references/native-measure-tti.md","pattern":"System reconnaissance","snippet":"**Android (Kotlin):**","category":"blocker","line_end":75,"severity":"low","line_start":75},{"id":"blocker:references/native-measure-tti.md:221:system-reconnaissance","file":"references/native-measure-tti.md","pattern":"System reconnaissance","snippet":"- [bundle-hermes-mmap.md](./bundle-hermes-mmap.md) - Improve Android TTI","category":"blocker","line_end":221,"severity":"low","line_start":221},{"id":"blocker:references/native-memory-leaks.md:9:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"Find native memory leaks using Xcode Leaks and Android Studio Memory Profiler.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/native-memory-leaks.md:18:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"# Android Studio → Run → Profile → Track Memory Consumption","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:references/native-memory-leaks.md:63:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"void createNewStrings() {","category":"blocker","line_end":63,"severity":"low","line_start":63},{"id":"blocker:references/native-memory-leaks.md:74:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"Use Android Studio Memory Profiler and select a memory-consumption recording for the target process.","category":"blocker","line_end":74,"severity":"low","line_start":74},{"id":"blocker:references/native-memory-leaks.md:91:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"### LeakCanary (Android JVM Leaks)","category":"blocker","line_end":91,"severity":"low","line_start":91},{"id":"blocker:references/native-memory-leaks.md:93:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"Use LeakCanary as a debug-only first line of defense for Android JVM leaks such as retained Activity","category":"blocker","line_end":93,"severity":"low","line_start":93},{"id":"blocker:references/native-memory-leaks.md:95:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"### Common Android Leak: Listener Not Removed","category":"blocker","line_end":95,"severity":"low","line_start":95},{"id":"blocker:references/native-memory-leaks.md:139:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"### Android","category":"blocker","line_end":141,"severity":"low","line_start":139},{"id":"blocker:references/native-memory-leaks.md:173:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"void process() {","category":"blocker","line_end":173,"severity":"low","line_start":173},{"id":"blocker:references/native-memory-leaks.md:180:system-reconnaissance","file":"references/native-memory-leaks.md","pattern":"System reconnaissance","snippet":"void process() {","category":"blocker","line_end":180,"severity":"low","line_start":180},{"id":"blocker:references/native-memory-patterns.md:36:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"void takeOwnership(std::unique_ptr<std::string> s) {","category":"blocker","line_end":36,"severity":"low","line_start":36},{"id":"blocker:references/native-memory-patterns.md:55:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"void useShared(std::shared_ptr<std::string> s) {","category":"blocker","line_end":55,"severity":"low","line_start":55},{"id":"blocker:references/native-memory-patterns.md:59:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"void useReference(const std::shared_ptr<std::string>& s) {","category":"blocker","line_end":59,"severity":"low","line_start":59},{"id":"blocker:references/native-memory-patterns.md:69:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"std::cout << *str;   // Still valid","category":"blocker","line_end":70,"severity":"low","line_start":69},{"id":"blocker:references/native-memory-patterns.md:77:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"void useWeak(std::weak_ptr<std::string> weak) {","category":"blocker","line_end":77,"severity":"low","line_start":77},{"id":"blocker:references/native-memory-patterns.md:136:system-reconnaissance","file":"references/native-memory-patterns.md","pattern":"System reconnaissance","snippet":"## Kotlin/Android GC","category":"blocker","line_end":136,"severity":"low","line_start":136},{"id":"filesystem:references/native-platform-setup.md:112:path-traversal-sequence","file":"references/native-platform-setup.md","pattern":"Path traversal sequence","snippet":"- [upgrading-react-native.md](../../upgrading-react-native/references/upgrading-react-native.md) - U","category":"filesystem","line_end":112,"severity":"high","line_start":112},{"id":"blocker:references/native-platform-setup.md:9:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"Navigate iOS and Android tooling, dependency management, and build systems in React Native.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/native-platform-setup.md:17:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"| Android | Android Studio | Gradle | Gradle |","category":"blocker","line_end":17,"severity":"low","line_start":17},{"id":"blocker:references/native-platform-setup.md:23:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew tasks       # Verify Gradle wrapper and tasks","category":"blocker","line_end":23,"severity":"low","line_start":23},{"id":"blocker:references/native-platform-setup.md:36:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"React Native autolinking only handles libraries structured as React Native modules. React Native pac","category":"blocker","line_end":36,"severity":"low","line_start":36},{"id":"blocker:references/native-platform-setup.md:57:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"### Android (Gradle)","category":"blocker","line_end":57,"severity":"low","line_start":57},{"id":"blocker:references/native-platform-setup.md:61:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew tasks","category":"blocker","line_end":61,"severity":"low","line_start":61},{"id":"blocker:references/native-platform-setup.md:70:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"Use exact Gradle dependency versions in production. Avoid dynamic `+` versions because they can chan","category":"blocker","line_end":70,"severity":"low","line_start":70},{"id":"blocker:references/native-platform-setup.md:80:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"# Android","category":"blocker","line_end":81,"severity":"low","line_start":80},{"id":"blocker:references/native-platform-setup.md:81:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"cd android && ./gradlew clean          # Clean build","category":"blocker","line_end":81,"severity":"low","line_start":81},{"id":"blocker:references/native-platform-setup.md:88:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"npx react-native run-android           # Run on Android","category":"blocker","line_end":88,"severity":"low","line_start":88},{"id":"blocker:references/native-platform-setup.md:93:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"npx expo run:android                   # Run on Android (dev client)","category":"blocker","line_end":93,"severity":"low","line_start":93},{"id":"blocker:references/native-platform-setup.md:103:system-reconnaissance","file":"references/native-platform-setup.md","pattern":"System reconnaissance","snippet":"| Android Gradle sync fails | Open Android Studio sync details, then run the failing Gradle task dir","category":"blocker","line_end":103,"severity":"low","line_start":103},{"id":"blocker:references/native-profiling.md:9:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"Use Xcode Instruments and Android Studio Profiler to identify native performance bottlenecks.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/native-profiling.md:18:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"# Android Studio → View → Tool Windows → Profiler","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:references/native-profiling.md:29:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"> **Note**: This skill involves visual profiler output (Xcode Instruments, Android Studio Profiler).","category":"blocker","line_end":29,"severity":"low","line_start":29},{"id":"blocker:references/native-profiling.md:69:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"## Android Profiling with Android Studio","category":"blocker","line_end":69,"severity":"low","line_start":69},{"id":"blocker:references/native-profiling.md:73:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"Use Android Studio Profiler on the target device or emulator.","category":"blocker","line_end":73,"severity":"low","line_start":73},{"id":"blocker:references/native-profiling.md:109:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"| CPU Profiler | Android | CPU hotspots |","category":"blocker","line_end":109,"severity":"low","line_start":109},{"id":"blocker:references/native-profiling.md:110:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"| Memory Profiler | Android | Memory tracking |","category":"blocker","line_end":110,"severity":"low","line_start":110},{"id":"blocker:references/native-profiling.md:111:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"| Perfetto | Android | Advanced trace analysis |","category":"blocker","line_end":111,"severity":"low","line_start":111},{"id":"blocker:references/native-profiling.md:115:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"Export traces from Android Studio and analyze at [ui.perfetto.dev](https://ui.perfetto.dev/):","category":"blocker","line_end":115,"severity":"low","line_start":115},{"id":"blocker:references/native-profiling.md:124:system-reconnaissance","file":"references/native-profiling.md","pattern":"System reconnaissance","snippet":"- **Dev Client / Prebuild**: Full native profiling supported via Xcode/Android Studio","category":"blocker","line_end":124,"severity":"low","line_start":124},{"id":"blocker:references/native-profiling.md:56:network-reconnaissance","file":"references/native-profiling.md","pattern":"Network reconnaissance","snippet":"- **Microhang**: Brief UI unresponsiveness","category":"blocker","line_end":57,"severity":"low","line_start":56},{"id":"blocker:references/native-threading-model.md:35:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Main/UI | Main thread | UI rendering, UIKit/Android Views |","category":"blocker","line_end":35,"severity":"low","line_start":35},{"id":"blocker:references/native-threading-model.md:47:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Android (lazy) | JS thread | Default behavior |","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:references/native-threading-model.md:48:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Android (eager) | Native modules thread | When `needsEagerInit = true` |","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:references/native-threading-model.md:52:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"**Android Eager Loading:**","category":"blocker","line_end":52,"severity":"low","line_start":52},{"id":"blocker:references/native-threading-model.md:108:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"// Android - runs on native modules thread","category":"blocker","line_end":108,"severity":"low","line_start":108},{"id":"blocker:references/native-threading-model.md:122:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Android | ReactHost thread pool |","category":"blocker","line_end":122,"severity":"low","line_start":122},{"id":"blocker:references/native-threading-model.md:136:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"Views always manipulate UI on main thread (UIKit/Android requirement).","category":"blocker","line_end":136,"severity":"low","line_start":136},{"id":"blocker:references/native-threading-model.md:138:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"Do not use a hard-coded \"Yoga runs on X thread\" rule when diagnosing performance. React Native's ren","category":"blocker","line_end":138,"severity":"low","line_start":138},{"id":"blocker:references/native-threading-model.md:217:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Action | iOS Thread | Android Thread |","category":"blocker","line_end":217,"severity":"low","line_start":217},{"id":"blocker:references/native-threading-model.md:219:system-reconnaissance","file":"references/native-threading-model.md","pattern":"System reconnaissance","snippet":"| Module init | Version/setup dependent; avoid blocking | Version/setup dependent; avoid blocking |","category":"blocker","line_end":219,"severity":"low","line_start":219},{"id":"blocker:references/native-turbo-modules.md:62:system-reconnaissance","file":"references/native-turbo-modules.md","pattern":"System reconnaissance","snippet":"- Android (Kotlin) support","category":"blocker","line_end":62,"severity":"low","line_start":62},{"id":"blocker:references/native-turbo-modules.md:111:system-reconnaissance","file":"references/native-turbo-modules.md","pattern":"System reconnaissance","snippet":"Use structured concurrency: keep a module-owned `CoroutineScope`, cancel it in `invalidate()`, avoid","category":"blocker","line_end":111,"severity":"low","line_start":111},{"id":"blocker:references/native-turbo-modules.md:135:system-reconnaissance","file":"references/native-turbo-modules.md","pattern":"System reconnaissance","snippet":"Follow the registration mechanism documented for the React Native version you target. Avoid copying ","category":"blocker","line_end":135,"severity":"low","line_start":135},{"id":"blocker:references/native-turbo-modules.md:151:system-reconnaissance","file":"references/native-turbo-modules.md","pattern":"System reconnaissance","snippet":"| Kotlin ↔ C++ (JNI) | Higher | Batch calls and avoid per-item crossings |","category":"blocker","line_end":151,"severity":"low","line_start":151},{"id":"blocker:references/native-turbo-modules.md:167:system-reconnaissance","file":"references/native-turbo-modules.md","pattern":"System reconnaissance","snippet":"// Android implementation","category":"blocker","line_end":167,"severity":"low","line_start":167},{"id":"blocker:references/native-view-flattening.md:38:system-reconnaissance","file":"references/native-view-flattening.md","pattern":"System reconnaissance","snippet":"> **Note**: This skill involves visual view hierarchy tools (Xcode Debug View Hierarchy, Android Lay","category":"blocker","line_end":38,"severity":"low","line_start":38},{"id":"blocker:references/native-view-flattening.md:87:system-reconnaissance","file":"references/native-view-flattening.md","pattern":"System reconnaissance","snippet":"### Android Studio","category":"blocker","line_end":87,"severity":"low","line_start":87},{"id":"blocker:references/native-view-flattening.md:89:system-reconnaissance","file":"references/native-view-flattening.md","pattern":"System reconnaissance","snippet":"1. Run app via Android Studio","category":"blocker","line_end":89,"severity":"low","line_start":89},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 1 | FPS & Re-renders | CRITICAL | `js-*` |","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 2 | Bundle Size | CRITICAL | `bundle-*` |","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 3 | TTI Optimization | HIGH | `native-*`, `bundle-*` |","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 4 | Native Performance | HIGH | `native-*` |","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 5 | Memory Management | MEDIUM-HIGH | `js-*`, `native-*` |","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 6 | Animations | MEDIUM | `js-*` |","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Check library versions before suggesting API-specific fixes. Example: FlashList v2 deprecates `est","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Do not suggest `useMemo` or `useCallback` dependency changes unless behavior is demonstrably incor","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":77,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Drive the target interaction with normal `agent-device` commands between `profile start` and `profil","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Manual fallback when `agent-device` is unavailable: open React Native DevTools from Metro (`j`) or t","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For release-build React component profiling, connect [`@callstack/inspector`](https://github.com/cal","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `useDeferredValue` for expensive computations","category":"external_commands","line_end":94,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":103,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":106,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":114,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `react-native-performance` for markers","category":"external_commands","line_end":148,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### JavaScript/React (`js-*`)","category":"external_commands","line_end":153,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| [js-profile-react.md][js-profile-react] | MEDIUM | `agent-device react-devtools` profiling |","category":"external_commands","line_end":163,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### Native (`native-*`)","category":"external_commands","line_end":178,"severity":"medium","line_start":163},{"id":"network:SKILL.md:83:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"For release-build React component profiling, connect [`@callstack/inspector`](https://github.com/cal","category":"network","line_end":83,"severity":"low","line_start":83},{"id":"filesystem:SKILL.md:129:memory-mapped-file-access","file":"SKILL.md","pattern":"Memory-mapped file access","snippet":"- For React Native 0.78 and earlier, disable Android JS bundle compression to enable Hermes mmap","category":"filesystem","line_end":129,"severity":"high","line_start":129},{"id":"filesystem:SKILL.md:187:memory-mapped-file-access","file":"SKILL.md","pattern":"Memory-mapped file access","snippet":"| [bundle-hermes-mmap.md][bundle-hermes-mmap] | HIGH | Disable bundle compression |","category":"filesystem","line_end":187,"severity":"high","line_start":187},{"id":"filesystem:SKILL.md:234:memory-mapped-file-access","file":"SKILL.md","pattern":"Memory-mapped file access","snippet":"[bundle-hermes-mmap]: references/bundle-hermes-mmap.md","category":"filesystem","line_end":234,"severity":"high","line_start":234},{"id":"blocker:SKILL.md:29:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Treat shell commands in these references as local developer operations. Review them before running","category":"blocker","line_end":29,"severity":"low","line_start":29},{"id":"blocker:SKILL.md:57:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"If metrics did not improve, revert and try the next suggested fix.","category":"blocker","line_end":57,"severity":"low","line_start":57},{"id":"blocker:SKILL.md:117:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid barrel imports (import directly from source)","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:SKILL.md:120:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Enable R8 for Android native code shrinking","category":"blocker","line_end":120,"severity":"low","line_start":120},{"id":"blocker:SKILL.md:129:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- For React Native 0.78 and earlier, disable Android JS bundle compression to enable Hermes mmap","category":"blocker","line_end":129,"severity":"low","line_start":129},{"id":"blocker:SKILL.md:137:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Android: Android Studio → CPU Profiler","category":"blocker","line_end":137,"severity":"low","line_start":137},{"id":"blocker:SKILL.md:171:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| [native-profiling.md][native-profiling] | MEDIUM | Xcode/Android Studio profiling |","category":"blocker","line_end":171,"severity":"low","line_start":171},{"id":"blocker:SKILL.md:172:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| [native-platform-setup.md][native-platform-setup] | MEDIUM | iOS/Android tooling guide |","category":"blocker","line_end":172,"severity":"low","line_start":172},{"id":"blocker:SKILL.md:182:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| [bundle-barrel-exports.md][bundle-barrel-exports] | CRITICAL | Avoid barrel imports |","category":"blocker","line_end":182,"severity":"low","line_start":182},{"id":"blocker:SKILL.md:186:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| [bundle-r8-android.md][bundle-r8-android] | HIGH | Android code shrinking |","category":"blocker","line_end":186,"severity":"low","line_start":186},{"id":"metadata:references/images/expo-atlas-treemap.png:1:unscanned-file-binary-manual-review-required","file":"references/images/expo-atlas-treemap.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/view-hierarchy-flattening.png:1:unscanned-file-binary-manual-review-required","file":"references/images/view-hierarchy-flattening.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/bundle-treemap-source-map-explorer.png:1:unscanned-file-binary-manual-review-required","file":"references/images/bundle-treemap-source-map-explorer.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/memory-heap-snapshot.png:1:unscanned-file-binary-manual-review-required","file":"references/images/memory-heap-snapshot.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/devtools-flamegraph.png:1:unscanned-file-binary-manual-review-required","file":"references/images/devtools-flamegraph.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/xcode-instruments-templates.png:1:unscanned-file-binary-manual-review-required","file":"references/images/xcode-instruments-templates.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/fps-drop-graph.png:1:unscanned-file-binary-manual-review-required","file":"references/images/fps-drop-graph.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/tti-warm-start-diagram.png:1:unscanned-file-binary-manual-review-required","file":"references/images/tti-warm-start-diagram.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/xcode-thread-view.png:1:unscanned-file-binary-manual-review-required","file":"references/images/xcode-thread-view.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/emerge-xray-ios.png:1:unscanned-file-binary-manual-review-required","file":"references/images/emerge-xray-ios.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/controlled-textinput-pingpong.png:1:unscanned-file-binary-manual-review-required","file":"references/images/controlled-textinput-pingpong.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:references/images/flashlight-flatlist-vs-flashlist.png:1:unscanned-file-binary-manual-review-required","file":"references/images/flashlight-flatlist-vs-flashlist.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1}],"finding_verdicts":[{"id":"filesystem:POWER.md:63:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:POWER.md:142:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"blocker:POWER.md:54:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:POWER.md:62:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:POWER.md:132:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:POWER.md:135:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:POWER.md:142:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:POWER.md:150:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:9:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:14:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:15:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:73:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:158:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:186:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:187:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-app.md:206:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"env_access:references/bundle-analyze-js.md:160:environment-variable-access-dot-notation","reason":"The example uses process.env.RSDOCTOR as a local build flag to enable a bundle analyzer. It does not read secrets or transmit environment variables.","verdict":"false_positive","confidence":0.93},{"id":"env_access:references/bundle-analyze-js.md:160:environment-variable-object","reason":"The example uses process.env.RSDOCTOR as a local build flag to enable a bundle analyzer. It does not read secrets or transmit environment variables.","verdict":"false_positive","confidence":0.93},{"id":"sensitive:references/bundle-analyze-js.md:160:environment-file-access","reason":"The .env references document public Expo or Metro feature flags for tree shaking and bundle analysis. They do not request secrets or expose dotenv contents.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-js.md:142:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-js.md:241:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-analyze-js.md:245:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/bundle-barrel-exports.md:221:path-traversal-sequence","reason":"The ../ sequence is a normal relative import or markdown link in documentation. It is not path traversal based on untrusted input and performs no file access.","verdict":"false_positive","confidence":0.95},{"id":"sensitive:references/bundle-barrel-exports.md:138:environment-file-access","reason":"The .env references document public Expo or Metro feature flags for tree shaking and bundle analysis. They do not request secrets or expose dotenv contents.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-barrel-exports.md:2:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-barrel-exports.md:7:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"scripts:references/bundle-code-splitting.md:23:dynamic-import-expression","reason":"The dynamic import appears in React.lazy or Re.Pack code-splitting examples with fixed module names and first-party safeguards. It is not arbitrary user-supplied code execution by the skill.","verdict":"false_positive","confidence":0.92},{"id":"scripts:references/bundle-code-splitting.md:72:dynamic-import-expression","reason":"The dynamic import appears in React.lazy or Re.Pack code-splitting examples with fixed module names and first-party safeguards. It is not arbitrary user-supplied code execution by the skill.","verdict":"false_positive","confidence":0.92},{"id":"scripts:references/bundle-code-splitting.md:74:dynamic-import-expression","reason":"The dynamic import appears in React.lazy or Re.Pack code-splitting examples with fixed module names and first-party safeguards. It is not arbitrary user-supplied code execution by the skill.","verdict":"false_positive","confidence":0.92},{"id":"scripts:references/bundle-code-splitting.md:164:dynamic-import-expression","reason":"The dynamic import appears in React.lazy or Re.Pack code-splitting examples with fixed module names and first-party safeguards. It is not arbitrary user-supplied code execution by the skill.","verdict":"false_positive","confidence":0.92},{"id":"scripts:references/bundle-code-splitting.md:194:dynamic-import-expression","reason":"The dynamic import appears in React.lazy or Re.Pack code-splitting examples with fixed module names and first-party safeguards. It is not arbitrary user-supplied code execution by the skill.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:references/bundle-code-splitting.md:115:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:references/bundle-code-splitting.md:231:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:references/bundle-code-splitting.md:235:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:references/bundle-code-splitting.md:214:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:references/bundle-code-splitting.md:221:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/bundle-code-splitting.md:129:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/bundle-hermes-mmap.md:4:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:references/bundle-hermes-mmap.md:35:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:references/bundle-hermes-mmap.md:135:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/bundle-hermes-mmap.md:9:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:15:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:22:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:26:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:33:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:48:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:60:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:70:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-hermes-mmap.md:93:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"network:references/bundle-library-size.md:15:hardcoded-url","reason":"The URL is a public documentation or analysis-tool reference, not an automatic outbound request. The skill does not send data to that URL.","verdict":"false_positive","confidence":0.91},{"id":"network:references/bundle-library-size.md:104:hardcoded-url","reason":"The URL is a public documentation or analysis-tool reference, not an automatic outbound request. The skill does not send data to that URL.","verdict":"false_positive","confidence":0.91},{"id":"blocker:references/bundle-native-assets.md:47:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-native-assets.md:53:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-native-assets.md:208:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:9:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:17:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:29:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:59:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-r8-android.md:98:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"scripts:references/bundle-tree-shaking.md:208:dynamic-require-with-variable","reason":"The text warns that require(variable) prevents static analysis. It is defensive documentation, not code executed by the skill.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/bundle-tree-shaking.md:27:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:references/bundle-tree-shaking.md:14:environment-file-access","reason":"The .env references document public Expo or Metro feature flags for tree shaking and bundle analysis. They do not request secrets or expose dotenv contents.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:references/bundle-tree-shaking.md:75:environment-file-access","reason":"The .env references document public Expo or Metro feature flags for tree shaking and bundle analysis. They do not request secrets or expose dotenv contents.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-tree-shaking.md:119:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-tree-shaking.md:123:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/bundle-tree-shaking.md:206:network-reconnaissance","reason":"The match is performance documentation or terminology, not network scanning or host discovery. No automated network enumeration behavior is present.","verdict":"false_positive","confidence":0.92},{"id":"blocker:references/js-animations-reanimated.md:144:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-animations-reanimated.md:224:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-atomic-state.md:32:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-atomic-state.md:94:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-atomic-state.md:99:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-atomic-state.md:122:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-atomic-state.md:188:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-bottomsheet.md:78:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-concurrent-react.md:13:keylogger-keywords","reason":"The terms are used to discuss TextInput responsiveness and rendering latency. There is no key capture, logging, persistence, or exfiltration behavior.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/js-concurrent-react.md:166:keylogger-keywords","reason":"The terms are used to discuss TextInput responsiveness and rendering latency. There is no key capture, logging, persistence, or exfiltration behavior.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/js-lists-flatlist-flashlist.md:197:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-measure-fps.md:32:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-measure-fps.md:42:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-measure-fps.md:60:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-profile-react.md:130:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/js-uncontrolled-components.md:9:keylogger-keywords","reason":"The terms are used to discuss TextInput responsiveness and rendering latency. There is no key capture, logging, persistence, or exfiltration behavior.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/js-uncontrolled-components.md:31:keylogger-keywords","reason":"The terms are used to discuss TextInput responsiveness and rendering latency. There is no key capture, logging, persistence, or exfiltration behavior.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/js-uncontrolled-components.md:54:keylogger-keywords","reason":"The terms are used to discuss TextInput responsiveness and rendering latency. There is no key capture, logging, persistence, or exfiltration behavior.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/js-uncontrolled-components.md:30:network-reconnaissance","reason":"The match is performance documentation or terminology, not network scanning or host discovery. No automated network enumeration behavior is present.","verdict":"false_positive","confidence":0.92},{"id":"filesystem:references/native-android-16kb-alignment.md:81:standard-device-file-access","reason":"The command searches node_modules inside the developer project to identify native library sources. It does not access sensitive system paths or send results externally.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/native-android-16kb-alignment.md:84:standard-device-file-access","reason":"The command searches node_modules inside the developer project to identify native library sources. It does not access sensitive system paths or send results externally.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:2:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:7:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:15:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:47:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:68:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:71:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-android-16kb-alignment.md:84:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/native-measure-tti.md:221:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/native-measure-tti.md:75:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-measure-tti.md:221:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:9:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:18:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:63:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:74:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:91:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:93:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:95:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:139:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:173:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-leaks.md:180:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:36:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:55:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:59:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:69:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:77:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-memory-patterns.md:136:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/native-platform-setup.md:112:path-traversal-sequence","reason":"The ../ sequence is a normal relative import or markdown link in documentation. It is not path traversal based on untrusted input and performs no file access.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/native-platform-setup.md:9:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:17:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:23:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:36:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:57:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:61:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:70:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:80:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:81:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:88:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:93:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-platform-setup.md:103:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:9:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:18:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:29:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:69:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:73:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:109:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:110:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:111:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:115:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:124:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-profiling.md:56:network-reconnaissance","reason":"The match is performance documentation or terminology, not network scanning or host discovery. No automated network enumeration behavior is present.","verdict":"false_positive","confidence":0.92},{"id":"blocker:references/native-threading-model.md:35:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:47:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:48:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:52:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:108:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:122:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:136:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:138:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:217:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-threading-model.md:219:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-turbo-modules.md:62:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-turbo-modules.md:111:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-turbo-modules.md:135:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-turbo-modules.md:151:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-turbo-modules.md:167:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-view-flattening.md:38:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-view-flattening.md:87:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/native-view-flattening.md:89:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The matched backticks are markdown inline code fences or JavaScript template literals inside examples, not Ruby shell execution. The examples do not pass user input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:83:hardcoded-url","reason":"The URL is a public documentation or analysis-tool reference, not an automatic outbound request. The skill does not send data to that URL.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:129:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:SKILL.md:187:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:SKILL.md:234:memory-mapped-file-access","reason":"The match is documentation about Hermes mmap behavior or a link to that reference, not code that opens or maps files. It is performance guidance and does not access local files or secrets.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:29:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:57:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:117:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:120:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:129:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:137:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:171:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:172:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:182:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:186:system-reconnaissance","reason":"The match is ordinary React Native performance documentation or a fixed local diagnostic command. It does not instruct stealthy host reconnaissance, credential collection, or exfiltration.","verdict":"false_positive","confidence":0.9},{"id":"metadata:references/images/expo-atlas-treemap.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/view-hierarchy-flattening.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/bundle-treemap-source-map-explorer.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/memory-heap-snapshot.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/devtools-flamegraph.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/xcode-instruments-templates.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/fps-drop-graph.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/tti-warm-start-diagram.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/xcode-thread-view.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/emerge-xray-ios.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/controlled-textinput-pingpong.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82},{"id":"metadata:references/images/flashlight-flatlist-vs-flashlist.png:1:unscanned-file-binary-manual-review-required","reason":"Manual review identified the file as a PNG documentation screenshot. It is not an executable script or active content in the skill package.","verdict":"false_positive","confidence":0.82}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}