{"data":{"skill":{"slug":"expo-upgrading-expo","name":"upgrading-expo","icon":"📦","repo":"https://github.com/expo/skills/tree/main/plugins/upgrading-expo/skills/upgrading-expo/","status":"approved","author":"expo","authorVersion":"1.0.0","skillstoreRevision":1},"audit":{"id":"ccc830fa-0062-4f00-8f62-ba73f3f28051","skill_id":"38f72859-7ec7-4778-8aaf-d184da29a597","version":5,"content_hash":"v3:30c73eac2afe762f6aa9c4553158769369d47351:2bfae3765925f0efba14fc0ddd93112d42d68535d89c453076435560cbf4fb32:58a73d677989b8dbef0824c7a4d02f9aa87f224795542ebdc0dfa5fbbfaebc18:736b696c6c732f6578706f2f757067726164696e672d6578706f:5b0a1aba5aef461901ad20b04a64fd99","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static findings are false positives caused by Markdown code fences, inline package names, and official Expo documentation links. I found no prompt injection, hidden execution, credential access, data exfiltration, or reconnaissance intent in the skill files.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":21,"line_start":18},{"file":"SKILL.md","line_end":23,"line_start":21},{"file":"SKILL.md","line_end":27,"line_start":23},{"file":"SKILL.md","line_end":31,"line_start":27},{"file":"SKILL.md","line_end":45,"line_start":31},{"file":"SKILL.md","line_end":47,"line_start":45},{"file":"SKILL.md","line_end":49,"line_start":47},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":54,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":54},{"file":"SKILL.md","line_end":61,"line_start":55},{"file":"SKILL.md","line_end":62,"line_start":61},{"file":"SKILL.md","line_end":63,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":73,"line_start":72},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":75,"line_start":75},{"file":"SKILL.md","line_end":84,"line_start":80},{"file":"SKILL.md","line_end":85,"line_start":84},{"file":"SKILL.md","line_end":92,"line_start":85},{"file":"SKILL.md","line_end":93,"line_start":92},{"file":"SKILL.md","line_end":99,"line_start":93}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":95,"line_start":95}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":320,"audit_model":"codex","audited_at":"2026-07-05T15:27:03.818+00:00","created_at":"2026-07-17T16:31:08.309+00:00","static_findings":[{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":21,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":23,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Run diagnostics: `npx expo-doctor`","category":"external_commands","line_end":27,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":31,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":47,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":49,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"This regenerates the `ios` and `android` directories. Ensure the project is not a bare workflow app ","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Clear the cocoapods cache for iOS: `cd ios && pod install --repo-update`","category":"external_commands","line_end":54,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Clear derived data for Xcode: `npx expo run:ios --no-build-cache`","category":"external_commands","line_end":55,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Clear the Gradle cache for Android: `cd android && ./gradlew clean`","category":"external_commands","line_end":61,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Enable React Compiler in SDK 54+ by adding `\"experiments\": { \"reactCompiler\": true }` to app.json ","category":"external_commands","line_end":62,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Delete sdkVersion from `app.json` to let Expo manage it automatically","category":"external_commands","line_end":63,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Remove implicit packages from `package.json`: `@babel/core`, `babel-preset-expo`, `expo-constants`","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `expo-av`            | `expo-audio` and `expo-video`                        |","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `expo-permissions`   | Individual package permission APIs                   |","category":"external_commands","line_end":73,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `@expo/vector-icons` | `expo-symbols` (for SF Symbols)                      |","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `AsyncStorage`       | `expo-sqlite/localStorage/install`                   |","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `expo-app-loading`   | `expo-splash-screen`                                 |","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Check if there are any outdated patches in the `patches/` directory. Remove them if they are no long","category":"external_commands","line_end":84,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `autoprefixer` isn't needed in SDK +53.","category":"external_commands","line_end":85,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `postcss.config.mjs` in SDK +53.","category":"external_commands","line_end":92,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `experimentalImportSupport` is enabled by default in SDK +54.","category":"external_commands","line_end":93,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `EXPO_USE_FAST_RESOLVER=1` is removed in SDK +54.","category":"external_commands","line_end":99,"severity":"medium","line_start":93},{"id":"network:SKILL.md:59:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Review release notes for the target SDK version at https://expo.dev/changelog","category":"network","line_end":59,"severity":"low","line_start":59},{"id":"network:SKILL.md:95:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Expo webpack is deprecated, migrate to [Expo Router and Metro web](https://docs.expo.dev/router/mi","category":"network","line_end":95,"severity":"low","line_start":95},{"id":"sensitive:SKILL.md:74:browser-storage-access","file":"SKILL.md","pattern":"Browser storage access","snippet":"| `AsyncStorage`       | `expo-sqlite/localStorage/install`                   |","category":"sensitive","line_end":74,"severity":"high","line_start":74},{"id":"blocker:SKILL.md:55:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Clear the Gradle cache for Android: `cd android && ./gradlew clean`","category":"blocker","line_end":55,"severity":"low","line_start":55},{"id":"blocker:SKILL.md:82:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"## Postcss","category":"blocker","line_end":84,"severity":"low","line_start":82}],"finding_verdicts":[{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"This is a Markdown code fence for visible Expo install examples, not Ruby or shell backtick execution. The skill does not dynamically execute the text.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for documented install commands. It is formatting, not executable code or command substitution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The line names npx expo-doctor as a standard diagnostic step for Expo projects. It is a visible developer command, not hidden execution or injection.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"This is a Markdown code fence for cache cleanup examples. The commands are documented maintenance steps, not code that the skill executes by itself.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for cache cleanup guidance. The surrounding text is instructional documentation, not runtime shell evaluation.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"This is a Markdown code fence introducing the Expo prebuild command. It is visible upgrade guidance, not hidden or dynamically constructed execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence after the prebuild example. It is formatting and does not execute a command.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The line explains that prebuild regenerates the ios and android directories using inline code formatting. It does not execute commands or access those paths.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The line documents a CocoaPods update command for iOS maintenance. It is a visible, standard Expo workflow step with no user-controlled command construction.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The line documents an Expo iOS cache cleanup command. It is instructional text and not automatic command execution by the skill.","verdict":"false_positive","confidence":0.89},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The line documents a Gradle clean command for Android builds. It is a normal project maintenance step and is not hidden execution or command injection.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The line shows an app.json configuration fragment for React Compiler. Inline backticks are used for formatting, not shell execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The line tells users to remove sdkVersion from app.json. It is configuration guidance and does not execute any external command.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The line lists package names to review in package.json. Inline backticks identify dependencies and do not indicate shell execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The line is a package replacement table entry for expo-av. It is dependency documentation, not an executable command.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The line is a package replacement table entry for expo-permissions. It is documentation and contains no shell execution path.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The line is a package replacement table entry for @expo/vector-icons. It uses inline formatting for package names only.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The line is a package replacement table entry for AsyncStorage. It names a migration target and does not run code.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The line is a package replacement table entry for expo-app-loading. It is static documentation, not executable behavior.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The line advises reviewing outdated project patches. It is manual cleanup guidance and does not execute file operations.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The line says autoprefixer is no longer needed for a specific SDK version. Inline formatting names a package, not a command.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The line names postcss.config.mjs as an SDK 53 configuration file. It is file guidance and contains no command execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The line names a Metro option that is enabled by default. Inline formatting identifies a setting, not an executable command.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The line notes that an Expo resolver environment flag was removed. It is compatibility documentation and does not read or set environment variables.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:59:hardcoded-url","reason":"The URL points to the official Expo changelog for release notes. It is a documentation link and the skill does not make automatic network requests.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:95:hardcoded-url","reason":"The URL points to official Expo documentation for migrating from Expo webpack. It is a reference link, not an exfiltration endpoint or runtime request.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:SKILL.md:74:browser-storage-access","reason":"The line mentions AsyncStorage only as a deprecated package table entry. There is no browser storage access, credential handling, or data extraction.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:55:system-reconnaissance","reason":"The Gradle clean command is a standard Android build cleanup step. It does not collect system information or perform reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:SKILL.md:82:network-reconnaissance","reason":"The cited location is a Postcss section heading and nearby configuration guidance. It contains no network probing or reconnaissance behavior.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":"30c73eac2afe762f6aa9c4553158769369d47351","subject_content_hash":"2bfae3765925f0efba14fc0ddd93112d42d68535d89c453076435560cbf4fb32","subject_tree_hash":"58a73d677989b8dbef0824c7a4d02f9aa87f224795542ebdc0dfa5fbbfaebc18","subject_plugin_path":"skills/expo/upgrading-expo","audit_payload_hash":"5b0a1aba5aef461901ad20b04a64fd99","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"30c73eac2afe762f6aa9c4553158769369d47351","contentHash":"2bfae3765925f0efba14fc0ddd93112d42d68535d89c453076435560cbf4fb32","treeHash":"58a73d677989b8dbef0824c7a4d02f9aa87f224795542ebdc0dfa5fbbfaebc18","pluginPath":"skills/expo/upgrading-expo","auditPayloadHash":"5b0a1aba5aef461901ad20b04a64fd99"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}