Expo App Store Deploy

Deploy Expo/React Native apps to Apple App Store and Google Play Store using EAS Build + Submit. Use when building iOS/Android production builds, submitting...

Security Scan

The skill's instructions and requirements match its stated purpose (using EAS to build and submit Expo apps); nothing requested is disproportionate or unrelated, though there are a few operational notes to be aware of.

Purpose & Capability

Name/description describe EAS build + submit for Expo/React Native and the SKILL.md contains the exact npx eas-cli commands you'd expect. The skill does not request unrelated credentials, binaries, or config paths.

Instruction Scope

Instructions are narrowly focused on running eas-cli for iOS/Android builds and submission. They correctly mention interactive Apple login and credential setup. Two notes: (1) the SKILL.md references 'references/guide.md' which is not present in the package (missing documentation), and (2) using npx to run eas-cli implies runtime fetching/execution of npm package code.

Install Mechanism

This is instruction-only (no install spec or code files), so nothing is written by the skill itself. However, commands expect npx eas-cli: npx will download and run code from the npm registry at invocation time — normal for CLI usage but worth noting as an execution-of-remote-code vector.

Credentials

The skill declares no environment variables and does not ask for unrelated secrets. Practically, running eas-cli will require access to Apple Developer and Google Play credentials (interactive login or service account keys), which are appropriate for the task but are sensitive and handled by the user/CLI rather than the skill.

Persistence & Privilege

always is false and there is no install or persistent configuration. The skill does not request elevated or permanent agent privileges.

Assessment

This skill appears to be what it says: a set of instructions for using eas-cli to build and submit Expo apps. Before using it: (1) verify you trust the skill source (it is instruction-only but runs npx which will fetch eas-cli at runtime), (2) prefer installing eas-cli yourself (e.g., npm install -g eas-cli or pin a specific version) rather than relying on npx to fetch an arbitrary latest package, (3) be prepared to provide sensitive Apple/Google credentials — use service accounts or App Store Connect API keys and CI secrets where possible, and do not paste passwords into untrusted prompts, (4) inspect your repository files (eas.json, app.config.ts) to ensure no secrets are committed, and (5) note that the referenced 'references/guide.md' is missing from the package — ask the publisher for the missing documentation if you need the detailed pipeline steps.

Full pipeline details in references/guide.md.

Quick Commands

# iOS: first-time (interactive Apple login required)
npx eas-cli build --platform ios --profile production

# iOS: subsequent builds
npx eas-cli build --platform ios --profile production --non-interactive

# Android
npx eas-cli build --platform android --profile production --non-interactive

# Submit
npx eas-cli submit --platform ios --id <BUILD_ID>
npx eas-cli submit --platform android --id <BUILD_ID>

# Build + submit in one step
npx eas-cli build --platform ios --profile production --auto-submit

Common Failures

Error	Fix
Install dependencies fails	Remove native packages from devDependencies
Credentials not set up	Run first build interactively (no --non-interactive)
Apple 2FA invalid code	Use SMS method, never reuse codes
ascAppId not allowed empty	Remove field on first submit, add returned ID after
Already submitted this build	Not an error - previous submission succeeded

Prerequisites

1. Apple Developer Program active
2. Google Play Console + identity verification complete
3. eas-cli installed: npx eas-cli --version
4. eas.json with projectId in app.config.ts

App Store Review Tips

• AI apps: expect 12+ or 17+ age rating requirement
• Microphone: NSMicrophoneUsageDescription must be clear
• External server dependency: handle offline gracefully
• Social login: Apple Sign In required if other social logins present
• Paid apps: Restore Purchases button required
• Demo account + server URL required in Review Notes
• All URLs (Privacy, Support, Marketing) must return HTTP 200 before submission