{"data":{"skill":{"slug":"expo-expo-cicd-workflows","name":"expo-cicd-workflows","icon":"📦","repo":"https://github.com/expo/skills/tree/main/plugins/expo-deployment/skills/expo-cicd-workflows/","status":"approved","author":"expo","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"84852642-450b-45e3-8f74-b39bfe3491d0","skill_id":"0dbc3b06-a61a-4ab4-b2cb-ccc1474f9c3a","version":1,"content_hash":"0731b9f067b4061d264cbdeac8fd4516","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis flagged 41 patterns including external commands and network access. All findings are FALSE POSITIVES. The scanner misclassified JavaScript template literals (backticks) as shell execution, the Fetch API as weak cryptography, and standard documentation URLs as security issues. This is a legitimate CI/CD helper skill with documented network access to Expo's official API endpoints.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"scripts/fetch.js","line_end":37,"line_start":37},{"file":"scripts/fetch.js","line_end":103,"line_start":99},{"file":"scripts/validate.js","line_end":34,"line_start":34},{"file":"scripts/validate.js","line_end":50,"line_start":50},{"file":"scripts/validate.js","line_end":50,"line_start":50},{"file":"scripts/validate.js","line_end":62,"line_start":60},{"file":"scripts/validate.js","line_end":76,"line_start":76},{"file":"scripts/validate.js","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":20,"line_start":17},{"file":"SKILL.md","line_end":42,"line_start":20},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":48,"line_start":42},{"file":"SKILL.md","line_end":49,"line_start":48},{"file":"SKILL.md","line_end":50,"line_start":49},{"file":"SKILL.md","line_end":51,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":58,"line_start":52},{"file":"SKILL.md","line_end":60,"line_start":58},{"file":"SKILL.md","line_end":61,"line_start":60},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":61},{"file":"SKILL.md","line_end":63,"line_start":62},{"file":"SKILL.md","line_end":64,"line_start":63},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":73,"line_start":65},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":75,"line_start":73},{"file":"SKILL.md","line_end":81,"line_start":75},{"file":"SKILL.md","line_end":86,"line_start":81}]},{"factor":"network","evidence":[{"file":"scripts/fetch.js","line_end":22,"line_start":22},{"file":"scripts/validate.js","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":34,"line_start":34}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"External Network Access","verdict":"FALSE_POSITIVE","locations":[{"file":"scripts/fetch.js","line_end":22,"line_start":22},{"file":"scripts/validate.js","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":34,"line_start":34}],"confidence":0.95,"description":"Skill fetches schema from Expo API endpoints. Network access is documented and limited to official expo.dev and GitHub domains.","confidence_reasoning":"Network access is intentional and documented. URLs point to official Expo services for schema retrieval."},{"title":"External Command References in Documentation","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":20,"line_start":17},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":86,"line_start":81}],"confidence":0.9,"description":"Documentation shows node command examples for running utility scripts. These are static documentation, not dynamic execution.","confidence_reasoning":"Backtick characters flagged as shell execution are JavaScript template literals for string interpolation in documentation examples."},{"title":"Script Execution Patterns","verdict":"FALSE_POSITIVE","locations":[{"file":"scripts/fetch.js","line_end":37,"line_start":37},{"file":"scripts/fetch.js","line_end":99,"line_start":99},{"file":"scripts/validate.js","line_end":34,"line_start":34},{"file":"scripts/validate.js","line_end":50,"line_start":50},{"file":"scripts/validate.js","line_end":62,"line_start":60},{"file":"scripts/validate.js","line_end":76,"line_start":76},{"file":"scripts/validate.js","line_end":78,"line_start":78}],"confidence":0.95,"description":"Utility scripts use child_process for npm install and script execution. Arguments are hardcoded strings, not user input.","confidence_reasoning":"Flagged backticks are template literals for string formatting, not shell command execution. No dynamic command construction found."}],"dangerous_patterns":[],"files_scanned":4,"total_lines":300,"audit_model":"claude","audited_at":"2026-01-23T07:06:56.07+00:00","created_at":"2026-01-23T07:22:51.964935+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}