Versioned security assessment

Report ID: SA-81D84EAB

1/23/2026, 5:20:42 AM

expo-deployment security assessment v1

Skill Security Certification Report

Audit History

Audit model: claude Historical report

Skill name: expo-deployment
Version: v1
Maintainer: expo
Source: github.com/expo/skills/tree/main/plugins/expo-deployment/skills/expo-deployment/
Coverage: 6 Files scanned · 1,534 Lines analyzed
Policy version: Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

All static findings are false positives. This is a documentation skill containing markdown files with example CLI commands. The scanner incorrectly flagged markdown code fences as shell backticks, algorithm names as weak crypto implementations, and configuration examples as credential access. No executable code exists in this skill.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

6 Files scanned · 1,534 Lines analyzed

0 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Not recorded by this audit

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (7)

Critical

SKILL.md:1-191

Heuristic: Dangerous Combination

Scanner flagged 'Code execution + Network + Credential access' combination. This is a documentation skill with example deployment commands. No actual dangerous code execution occurs.

Scanner heuristic triggered by example commands in documentation. No actual code execution or credential exfiltration exists.

High

SKILL.md:109 references/play-store.md:34 references/play-store.md:56

Credential JSON File References

Scanner flagged JSON examples containing service account key paths. These are configuration documentation examples, not actual credential files.

Documentation examples showing JSON configuration syntax for service account paths. No actual credentials or credential files present.

High

Weak Cryptographic Algorithm References

Scanner detected algorithm names in documentation text. These are mentions in documentation, not actual cryptographic implementations.

Algorithm names in documentation text discussing encryption standards. No actual cryptographic implementations exist.

High

references/app-store-metadata.md:292

Environment File Access Documentation

Scanner flagged environment variable documentation. These are legitimate documentation about configuration using environment variables.

Documentation about using environment variables for configuration in CI/CD pipelines. Standard practice, not a security issue.

Medium

SKILL.md:26-29 SKILL.md:33-35 SKILL.md:37-43 SKILL.md:52-56 SKILL.md:65-71 SKILL.md:78-82 SKILL.md:84-115 SKILL.md:121-122 SKILL.md:142 SKILL.md:163 SKILL.md:169-171 SKILL.md:177 SKILL.md:181

Shell Command Documentation

Scanner flagged shell command examples in markdown code blocks. These are documentation examples, not actual command execution.

Markdown code blocks containing EAS CLI command examples. Standard documentation practice, no actual command execution.

Low

references/app-store-metadata.md:51-53 references/app-store-metadata.md:272 references/app-store-metadata.md:273 references/app-store-metadata.md:430 references/ios-app-store.md:5 references/play-store.md:5 references/workflows.md:19

Network URL References

Scanner detected hardcoded URLs in documentation. These are legitimate reference URLs for platform documentation.

Documentation URLs linking to official platform documentation (Apple, Google, Expo). Standard practice.

Low

System Command References

Scanner flagged build monitoring commands as 'system reconnaissance'. These are legitimate EAS CLI commands for checking build status.

EAS CLI commands for build monitoring and submission (eas build:list, eas build:view, eas submit:list). Standard deployment operations.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable