Skills expo-cicd-workflows
📦

expo-cicd-workflows

v1.0.0 Content revision r1 Low Risk ⚙️ External commands🌐 Network access

Build Expo CI/CD Workflows

Expo teams need current EAS workflow YAML that matches the live schema. This skill helps Claude, Codex, and Claude Code fetch references, draft workflows, and validate changes before use.

Supports: Claude Codex Code(CC)
📊 75 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "expo-cicd-workflows" from https://skillstore.io/skills/expo-expo-cicd-workflows.md and its manifest at https://skillstore.io/api/skills/expo-expo-cicd-workflows/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/expo-expo-cicd-workflows.md Signed manifest GET /api/skills/expo-expo-cicd-workflows/manifest Signed lockfile GET /api/skills/expo-expo-cicd-workflows/lockfile

Test it

Using "expo-cicd-workflows". Create a manual workflow for Android and iOS builds.

Expected outcome:

A workflow plan with a manual trigger, platform build jobs, required parameters, and validation notes.

Using "expo-cicd-workflows". Validate my release workflow against the current schema.

Expected outcome:

  • Reports whether the workflow is valid.
  • Lists schema errors in plain language.
  • Suggests focused fixes for invalid fields or references.

Using "expo-cicd-workflows". Explain which EAS workflow jobs are available today.

Expected outcome:

A current summary of supported job types, parameters, and outputs based on fetched Expo references.

Security Audit

Low Risk
v7 • 7/9/2026 Open versioned report

No prompt injection or secret exfiltration intent was found in the reviewed files. Most external-command findings are false positives from JavaScript template literals, Markdown fences, or inline code. The skill has intentional outbound network access for Expo references and should keep that access constrained.

3
Files scanned
288
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (1)

Low
scripts/fetch.js:95-107
Unrestricted Documentation Fetch URL
scripts/fetch.js reads a command-line URL and fetches it without host allowlisting. The intended use is Expo documentation, but prompts could cause outbound requests to arbitrary domains.
The CLI path assigns process.argv[2] to url and passes it to fetchCached. No code in this file restricts the destination host.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
scripts/fetch.js:22
Fetch API call
const response = await fetch(url, {
The helper performs outbound HTTP requests to a caller-supplied URL and caches the response. This is intended for documentation fetches, with no secret exfiltration evidence, but it is real network capability.

Risk Factors

⚙️ External commands (26)
scripts/fetch.js:37 scripts/fetch.js:99-103 scripts/validate.js:34 scripts/validate.js:50 scripts/validate.js:60-62 scripts/validate.js:76 scripts/validate.js:78 SKILL.md:15 SKILL.md:17-20 SKILL.md:20-42 SKILL.md:42 SKILL.md:48-49 SKILL.md:49-50 SKILL.md:50-51 SKILL.md:51-52 SKILL.md:52-58 SKILL.md:58-60 SKILL.md:60-61 SKILL.md:61 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-73 SKILL.md:73 SKILL.md:75-81 SKILL.md:81-86
🌐 Network access (5)
scripts/fetch.js:22 scripts/validate.js:13 SKILL.md:22 SKILL.md:29 SKILL.md:34
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/expo-expo-cicd-workflows/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/expo-expo-cicd-workflows/security.svg)](https://skillstore.io/skills/expo-expo-cicd-workflows?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/expo-expo-cicd-workflows?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/expo-expo-cicd-workflows/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/expo-expo-cicd-workflows.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

expo. (2026). expo-cicd-workflows security audit report (audit version 7) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/expo-expo-cicd-workflows/audits/7

BibTeX citation

@techreport{expo-expo-expo-cicd-workflows-2026, author = {expo}, title = {expo-cicd-workflows security audit report (audit version 7)}, institution = {Skillstore}, year = {2026}, number = {7}, url = {https://skillstore.io/skills/expo-expo-cicd-workflows/audits/7}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "expo-cicd-workflows security audit report (audit version 7)" version: "1.0.0" type: report authors: - name: "expo" date-released: "2026-07-09" url: "https://skillstore.io/skills/expo-expo-cicd-workflows/audits/7" identifiers: - type: other value: "skillstore:expo-expo-cicd-workflows:audit:7" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
45
Architecture
100
Maintainability
85
Content
69
Community
91
Spec Compliance

What You Can Build

Create a release workflow

Draft a workflow that builds and submits an Expo app with schema-valid settings.

Validate deployment automation

Check existing EAS workflow files before merging release automation changes.

Standardize CI/CD templates

Create reusable workflow patterns for multiple Expo projects and teams.

Try These Prompts

Create a Basic Workflow 
Create an EAS workflow for my Expo app that runs on manual trigger and builds Android and iOS.
Validate an Existing Workflow 
Review .eas/workflows/release.yml, fetch the current Expo schema, and tell me what must change before it is valid.
Add Release Conditions 
Update my EAS workflow so production submission only runs for the main branch or a manual production input.
Design a Multi-Job Pipeline 
Design an EAS workflow with separate preview build, production build, and submit jobs. Validate dependencies and expression contexts.

Best Practices

  • Fetch the latest schema before creating or changing workflow files.
  • Validate every modified workflow before treating it as complete.
  • Keep job dependencies and expression contexts explicit and easy to review.

Avoid

  • Relying on memorized job types or enum values.
  • Writing workflow YAML without running schema validation.
  • Referencing outputs, contexts, or jobs that are not defined.

Frequently Asked Questions

Does this skill run EAS builds?
No. It helps create and validate workflow files, but it does not run builds or deployments.
Why does it fetch Expo resources?
EAS workflow syntax changes over time. Fetching current references helps avoid outdated job types and parameters.
Which files does it work with?
It focuses on YAML workflow files in .eas/workflows with .yml or .yaml extensions.
Can it validate multiple workflow files?
Yes. The included validator accepts one or more workflow files and checks them against the schema.
Does it require Node.js?
Yes. The included fetch and validation helpers are Node.js scripts.
Can it explain workflow options?
Yes. It can fetch current Expo references and summarize triggers, jobs, parameters, and outputs.

Developer Details

Author

expo

License

MIT License

Author version

v1.0.0

Skillstore revision

r1

Repository

https://github.com/expo/skills/tree/main/plugins/expo-deployment/skills/expo-cicd-workflows/

Ref

0519034dad657fb1f7706e0550e962beeda73fdf

Maintenance freshness

7/18/2026

Usage

4 downloads · 164 views

File structure

📁 scripts/

📄 fetch.js

📄 validate.js

📄 SKILL.md