No prompt injection or secret exfiltration intent was found in the reviewed files. Most external-command findings are false positives from JavaScript template literals, Markdown fences, or inline code. The skill has intentional outbound network access for Expo references and should keep that access constrained.
scripts/fetch.js reads a command-line URL and fetches it without host allowlisting. The intended use is Expo documentation, but prompts could cause outbound requests to arbitrary domains.
The CLI path assigns process.argv[2] to url and passes it to fetchCached. No code in this file restricts the destination host.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The helper performs outbound HTTP requests to a caller-supplied URL and caches the response. This is intended for documentation fetches, with no secret exfiltration evidence, but it is real network capability.
No prompt injection or secret exfiltration intent was found in the reviewed files. Most external-command findings are false positives from JavaScript template literals, Markdown fences, or inline code. The skill has intentional outbound network access for Expo references and should keep that access constrained.
scripts/fetch.js reads a command-line URL and fetches it without host allowlisting. The intended use is Expo documentation, but prompts could cause outbound requests to arbitrary domains.
The CLI path assigns process.argv[2] to url and passes it to fetchCached. No code in this file restricts the destination host.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The helper performs outbound HTTP requests to a caller-supplied URL and caches the response. This is intended for documentation fetches, with no secret exfiltration evidence, but it is real network capability.
Most static command findings are false positives caused by JavaScript template literals and Markdown inline code. The remaining confirmed findings are expected network fetches and documented Node or npm commands used for Expo workflow validation. No prompt injection, credential harvesting, data exfiltration, or destructive behavior was found in the reviewed files.
3
Files scanned
288
Lines analyzed
9
Review items
0
False positives ignored
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The Markdown code block instructs the agent to run a local Node fetch helper with a URL argument. This is intentional, but it is real command execution combined with network access.
The validation code block instructs agents to run npm install if dependencies are missing and then run the Node validator. This is expected for the skill, but it is real local command execution and dependency-install risk.
fetchCached performs a real outbound HTTP request to the caller-provided URL, then caches and prints the response. This is expected for public Expo references, but it is real network egress and should stay limited to trusted URLs.
The validator uses a hardcoded Expo schema endpoint that is fetched during validation. This is legitimate for current schema checks, but remote schema availability and content affect results.
The skill explicitly instructs agents to fetch the official Expo workflow schema URL. This is a legitimate public endpoint, but it creates a network dependency that can influence validation output.
The skill points to raw GitHub documentation that agents are expected to fetch for syntax guidance. The URL is public Expo documentation, but remote content changes can affect generated advice.
The skill points to raw GitHub documentation for pre-packaged jobs. This is expected documentation retrieval, but it is still a remote content dependency.
Most static command findings are false positives caused by JavaScript template literals and Markdown inline code. The remaining confirmed findings are expected network fetches and documented Node or npm commands used for Expo workflow validation. No prompt injection, credential harvesting, data exfiltration, or destructive behavior was found in the reviewed files.
3
Files scanned
288
Lines analyzed
9
Review items
0
False positives ignored
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The Markdown code block instructs the agent to run a local Node fetch helper with a URL argument. This is intentional, but it is real command execution combined with network access.
The validation code block instructs agents to run npm install if dependencies are missing and then run the Node validator. This is expected for the skill, but it is real local command execution and dependency-install risk.
fetchCached performs a real outbound HTTP request to the caller-provided URL, then caches and prints the response. This is expected for public Expo references, but it is real network egress and should stay limited to trusted URLs.
The validator uses a hardcoded Expo schema endpoint that is fetched during validation. This is legitimate for current schema checks, but remote schema availability and content affect results.
The skill explicitly instructs agents to fetch the official Expo workflow schema URL. This is a legitimate public endpoint, but it creates a network dependency that can influence validation output.
The skill points to raw GitHub documentation that agents are expected to fetch for syntax guidance. The URL is public Expo documentation, but remote content changes can affect generated advice.
The skill points to raw GitHub documentation for pre-packaged jobs. This is expected documentation retrieval, but it is still a remote content dependency.
Static analysis reported many high-risk patterns, but the apparent weak-crypto and shell-backtick detections are false positives after review. The confirmed risks are legitimate but elevated: helper scripts fetch official Expo workflow resources, read workflow files, write a local cache, and the skill instructs agents to run Node-based validation commands.
The helper scripts fetch the current Expo workflow schema and documentation from Expo-controlled URLs. This is legitimate for the skill purpose, but it introduces network dependency and remote-content trust considerations.
The fetch call and fixed schema URL are directly visible, and the skill explicitly requires fetching these resources. The URLs are official Expo resources, so this is a legitimate elevated risk rather than malicious behavior.
The skill allows Bash execution for Node commands and instructs agents to run helper scripts and install script dependencies. This is expected for workflow validation, but it expands execution risk compared with documentation-only skills.
The allowed tool declaration and command examples are explicit. The commands target local helper scripts, so the risk is from permitted execution scope rather than evidence of command injection.
The fetch helper creates a local cache and writes fetched data, while the validator reads user-specified workflow files. This matches the documented purpose and does not show evidence of unauthorized file access.
Filesystem reads and writes are directly present. The paths are either the cache directory or user-provided workflow files for validation, making the observed behavior expected and limited.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static Backtick Command Findings Are False Positives
The reported backtick findings are JavaScript template literals, Markdown code fences, inline code, or console output strings. No Ruby backtick execution or shell command interpolation was found in the reviewed files.
The reviewed contexts show formatting or JavaScript strings, not shell execution syntax. No dynamic child_process, eval, or Ruby-style backtick execution was present in these locations.
The only cryptographic API usage hashes a URL with SHA-256 to create a cache filename prefix. SHA-256 is not weak in this context and is not used for passwords, signatures, or encryption.
The code clearly uses createHash with sha256 only for deterministic cache naming. There is no security-sensitive cryptographic decision or weak algorithm evidence at this location.
No text was found that claims system authority, asks the evaluator to ignore instructions, or attempts to override the security review process.
The reviewed skill text contains task instructions for Expo workflow assistance, not evaluator-directed override language. This assessment is limited to the three audited files.
Static analysis detected patterns related to network calls and shell examples. Evaluation confirms these are legitimate: network access is limited to official Expo documentation endpoints, shell examples are documentation strings (not executable), and SHA-256 is a secure hashing algorithm. No malicious intent found. Safe for publication.
4
Files scanned
300
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static analysis flagged 41 patterns including external commands and network access. All findings are FALSE POSITIVES. The scanner misclassified JavaScript template literals (backticks) as shell execution, the Fetch API as weak cryptography, and standard documentation URLs as security issues. This is a legitimate CI/CD helper skill with documented network access to Expo's official API endpoints.
4
Files scanned
300
Lines analyzed
2
Review items
3
False positives ignored
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.