MiniMax React Native Dev

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:18 AM UTC
• Version: 1.0.0

Overview

This is a straightforward React Native and Expo development guide; its main risk is that some example setup commands run mutable npm tooling, which users should treat with normal developer supply-chain caution.

Before running the setup commands, consider pinning the Expo and create-expo-app versions, reviewing package provenance, and running project generation in a normal non-admin development environment without unnecessary credentials exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:100

Finding

Unpinned npm Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 100
Vulnerability Type: Unsafe execution of a mutable third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npx create-expo-app@latest my-app --template blank-typescript

Technical Analysis

The project setup instructions direct users to execute create-expo-app using the mutable latest npm distribution tag. The npx command can download the selected package from the configured npm registry and immediately execute its code with the privileges of the invoking user.

The latest tag can be reassigned and does not identify a fixed, previously reviewed package version. Consequently, the effective code executed by this instruction may change after the Skill has been audited. Although invoking project-generation tooling is necessary for the declared React Native and Expo development functionality, using an unpinned release is not necessary and introduces avoidable supply-chain risk.

This issue does not demonstrate that create-expo-app is currently malicious. The vulnerability is the instruction to trust and execute a mutable upstream package without version pinning or provenance verification.

Attack Path

1. An attacker compromises the upstream package, a maintainer account, the package publication process, or the npm registry path used by the victim.
2. The attacker publishes a malicious release and causes the mutable latest tag to resolve to it.
3. A user follows the Skill's initialization instructions and runs the documented npx command.
4. npx downloads the attacker-controlled package version and executes its project-generation code.
5. The malicious package operates with the user's current privileges and can access resources available to that user and process.

Impact Assessment

Successful exploitation permits arbitrary code execution under the account running the command. Depending on the local environment a ...[truncated 525 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an exact, reviewed version, for example:

   bash

   npx create-expo-app@X.Y.Z my-app --template blank-typescript
   

2. Periodically review and deliberately update the pinned version rather than allowing the selected release to change implicitly.

3. Instruct users to verify that the package resolves from the official npm registry and confirm its publisher, provenance, and expected package metadata before execution.

4. Where organizational controls are available, use an approved internal registry proxy, dependency allowlist, or package provenance policy.

5. Run project-generation tools in an isolated development environment with no unnecessary credentials and only the filesystem permissions required to create the target project.

6. Avoid running the initialization command as an administrator or root user.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run npx create-expo-app@latest, which fetches and executes the latest package version at runtime rather than a reviewed, fixed version. In a developer-facing skill, this creates a supply-chain risk: if the upstream package or a dependency is compromised, users may execute attacker-controlled code locally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The command npx expo install ... relies on npx expo without an explicit pinned CLI version, so execution may vary over time and may fetch unreviewed code depending on the environment. Because this skill is a setup guide intended to be copied and executed by developers, the lack of version pinning increases exposure to package compromise or breaking changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This npx expo install ... invocation again uses an unpinned package executable, which can pull and run code that differs from what the skill author originally validated. In a mobile-development skill, these commands are highly likely to be executed verbatim, making the supply-chain risk more practical than in purely informational text.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The recommendation npx expo start references an unpinned executable, so developers may run whichever version resolves in their environment or is fetched at execution time. While less directly dangerous than arbitrary shell scripting, it still introduces avoidable supply-chain and reproducibility risk in a guide that encourages command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The web support installation step uses npx expo install ... without pinning the Expo package version, leaving users dependent on mutable upstream state. If the package distribution path is compromised or unexpectedly changed, this command could execute unintended code on the developer workstation.

Content

No source excerpt is available for this finding.