Skills expo-build-deploy
📦
expo-build-deploy
Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables
Deploy Expo iOS Apps with EAS
iOS release work for Expo apps requires EAS profiles, credentials, TestFlight steps, and version rules. This skill gives focused checklists and commands for build, submit, OTA updates, and troubleshooting.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "expo-build-deploy" from https://skillstore.io/skills/cjharmath-expo-build-deploy.md and its manifest at https://skillstore.io/api/skills/cjharmath-expo-build-deploy/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "expo-build-deploy". Prepare my Expo app for TestFlight.
Expected outcome:
- Review bundle identifier, version, build number, and Apple team settings.
- Confirm credentials are ready in EAS or local files.
- Create a production build and submit it to TestFlight after confirmation.
Using "expo-build-deploy". My OTA update is not appearing.
Expected outcome:
- Check that the build channel matches the update branch.
- Confirm the app is not running in development mode.
- Restart the app after the update is available.
Using "expo-build-deploy". Plan an App Store release.
Expected outcome:
The skill returns a release checklist covering screenshots, privacy policy, age rating, export compliance, build selection, and review steps.
Security Audit
High Riskv7 • 7/5/2026 Open versioned report
Static command and network detections are mostly Markdown documentation false positives; the file contains no executable Ruby backtick code or autonomous outbound requests. The main confirmed risk is unsafe secret-handling guidance that can expose API keys through Expo client config and command history. No prompt injection language was found in SKILL.md.
1
Files scanned
423
Lines analyzed
3
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Environment file access
"apiKey": process.env.API_KEY
The snippet places process.env.API_KEY into Expo extra config and later reads it from client code. That can expose private API keys in the mobile app bundle.
High
Unsafe API Secret Exposure Guidance
The skill tells users to create an API_KEY secret, place process.env.API_KEY in Expo extra config, and read it from app code. Private secrets in client-visible Expo config can be extracted from mobile builds, and direct command values can expose secrets through shell history.
The guidance directly connects an API_KEY secret to Expo client config and app code. This is unsafe for private keys, although public values would be acceptable.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Environment variable access (dot notation)
"apiKey": process.env.API_KEY
The snippet places process.env.API_KEY into Expo extra config and later reads it from client code. That can expose private API keys in the mobile app bundle.
High
Environment variable object
"apiKey": process.env.API_KEY
The snippet places process.env.API_KEY into Expo extra config and later reads it from client code. That can expose private API keys in the mobile app bundle.
High
Generic API/secret keys
"apiKey": process.env.API_KEY
The snippet places process.env.API_KEY into Expo extra config and later reads it from client code. That can expose private API keys in the mobile app bundle.
Risk Factors
⚙️ External commands (55)
SKILL.md:12-21 SKILL.md:21-23 SKILL.md:23-25 SKILL.md:25-47 SKILL.md:47-51 SKILL.md:51-69 SKILL.md:69-75 SKILL.md:75-81 SKILL.md:81-83 SKILL.md:83-87 SKILL.md:87-89 SKILL.md:89-95 SKILL.md:95-97 SKILL.md:97-103 SKILL.md:103-113 SKILL.md:113-120 SKILL.md:120-122 SKILL.md:122-132 SKILL.md:132-138 SKILL.md:138-153 SKILL.md:153-157 SKILL.md:157-170 SKILL.md:170-174 SKILL.md:174-178 SKILL.md:178-184 SKILL.md:184-196 SKILL.md:196-198 SKILL.md:198 SKILL.md:202-211 SKILL.md:211-241 SKILL.md:241-244 SKILL.md:244-250 SKILL.md:250-256 SKILL.md:256-260 SKILL.md:260-271 SKILL.md:271-275 SKILL.md:275-291 SKILL.md:291-297 SKILL.md:297-303 SKILL.md:303-307 SKILL.md:307-315 SKILL.md:315-319 SKILL.md:319-329 SKILL.md:329-335 SKILL.md:335-338 SKILL.md:338-349 SKILL.md:349-353 SKILL.md:353-357 SKILL.md:357-359 SKILL.md:359-369 SKILL.md:369-373 SKILL.md:373-379 SKILL.md:379-390 SKILL.md:390-396 SKILL.md:396-422
🌐 Network access (3)
🔑 Env variables (4)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/cjharmath-expo-build-deploy/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/cjharmath-expo-build-deploy?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/cjharmath-expo-build-deploy?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cjharmath-expo-build-deploy/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/cjharmath-expo-build-deploy.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CJHarmath. (2026). expo-build-deploy security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cjharmath-expo-build-deploy/audits/7BibTeX citation
@techreport{cjharmath-cjharmath-expo-build-deploy-2026,
author = {CJHarmath},
title = {expo-build-deploy security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/cjharmath-expo-build-deploy/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "expo-build-deploy security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "CJHarmath"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/cjharmath-expo-build-deploy/audits/7"
identifiers:
- type: other
value: "skillstore:cjharmath-expo-build-deploy:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
72
Community
83
Spec Compliance
What You Can Build
Create a First iOS Build
Set up EAS for an Expo app and choose the right build profile.
Prepare TestFlight Delivery
Review App Store Connect fields, credentials, build numbers, and submit steps before tester release.
Resolve Build and Update Issues
Use targeted checks for signing errors, stuck processing, crashes, and OTA update delivery.
Try These Prompts
Set Up iOS Builds
Help me configure EAS Build for my Expo iOS app. Include the needed project files, profiles, and first build checks.
Prepare TestFlight Submission
Create a TestFlight submission plan for my Expo app. Cover credentials, build number, App Store Connect fields, and review steps.
Troubleshoot Build Failure
My Expo iOS build failed during signing. Walk me through likely causes, credential checks, and safe recovery steps.
Audit Release Workflow
Review my Expo iOS release workflow. Identify gaps in build profiles, OTA channels, versioning, credentials, and App Store submission readiness.
Best Practices
- Confirm the target EAS profile before every build or submission.
- Keep private keys on a backend and expose only public client configuration.
- Increase iOS build numbers for every App Store upload.
Avoid
- Do not paste private API keys into client-visible Expo config.
- Do not reset signing credentials without confirming team ownership and impact.
- Do not publish OTA updates to production without matching the release channel.
Frequently Asked Questions
Does this skill support Android releases?
No. It focuses on Expo iOS builds, TestFlight, App Store submission, and iOS troubleshooting.
Can it create Apple Developer accounts?
No. It explains where account, team, and App Store Connect information fits into the workflow.
Does it run builds automatically?
No. It provides commands and checklists that an agent or user can apply with confirmation.
Can it manage certificates?
It explains EAS credential options and manual credential concepts. It does not verify private certificate files.
Does it cover OTA updates?
Yes. It documents update branches, channels, common publish steps, and troubleshooting checks.
Is it safe for private API keys?
Use caution. Private keys should stay on a backend and should not be exposed in client app config.