Expor Native UI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:36 PM UTC
• Version: 1.0.0

Overview

This is a documented Expo/React Native guidance skill with some supply-chain and permission-practice caveats, but no hidden execution, exfiltration, or deceptive behavior was found.

Install only if you are comfortable with Expo/React Native guidance that may recommend running unpinned npm/npx commands. For safer use, pin installer and dependency versions, review package lockfile changes, avoid --legacy-peer-deps unless necessary, and request camera/microphone/media permissions only after a clear user action in the app you build.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:30
• Finding: Unpinned Packages and Mutable Remote Sources Executed Through npx<![CDATA[ ## Vulnerability Details **File Locations**: - `README.md:30` - `README.md:36` - `SKILL.md:21` - `SKILL.md:74` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash # README.md:30 npx add https://github.com/wpank/ai/tree/main/skills/frontend/expo-native-ui # README.md:36 and SKILL.md:21 npx clawhub@latest install expo-native-ui # SKILL.md:74 npx expo start # Scan QR with Expo Go ``` ### Technical Analysis The documented commands use `npx` to retrieve and execute npm packages without pinning them to reviewed, immutable versions. In particular: - `clawhub@latest` explicitly selects whichever release currently owns the `latest` distribution tag. - `npx expo start` may download and execute the current matching package when Expo is not already installed locally. - `npx add` invokes an implicitly versioned package named `add`. - The GitHub installation source refers to a mutable repository branch path rather than an immutable commit. Packages executed through `npx` can run package code and lifecycle behavior with the permissions of the invoking user. Consequently, the effective executable content can change after the Skill has been reviewed. This is a supply-chain weakness rather than evidence that the currently referenced packages are malicious. ### Attack Path 1. An attacker compromises the npm account, package publication pipeline, distribution tag, or mutable GitHub repository referenced by the documentation. 2. The attacker publishes malicious package code or replaces repository content while retaining the expected package name or URL. 3. A user or AI agent follows the Skill's installation or startup instructions. 4. `npx` resolves and downloads the current remote content. 5. The downloaded package executes under the user's account. 6. The payload can access files, environment variables, network resources, and processes available to that user. ### Impact Assessment Successful expl ...[truncated 654 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` and implicit package versions with exact, reviewed versions. 2. Reference GitHub content by an immutable commit hash rather than a mutable branch. 3. Document package provenance and expected integrity hashes. 4. Install dependencies into the project under a committed lockfile before invoking them. 5. Prefer deterministic installation commands such as `npm ci`. 6. Configure CI to verify lockfile integrity and reject unexpected dependency changes. 7. Review package lifecycle scripts before installation and use `--ignore-scripts` where lifecycle execution is unnecessary. 8. Replace the ambiguous `npx add` command with an explicitly identified, pinned, and verified installer. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/webgpu-three.md:22
• Finding: Mutable Native Dependencies Installed with Peer-Dependency Validation Disabled<![CDATA[ ## Vulnerability Details **File Location**: `references/webgpu-three.md:22` **Vulnerability Type**: Non-deterministic dependency installation with compatibility checks bypassed **Risk Level**: Medium ### Vulnerable Code ```bash npm install react-native-wgpu@^0.4.1 three@0.172.0 @react-three/fiber@^9.4.0 wgpu-matrix@^3.0.2 @types/three@0.172.0 --legacy-peer-deps ``` ### Technical Analysis The installation command combines mutable semantic-version ranges with `--legacy-peer-deps`: - `react-native-wgpu@^0.4.1` - `@react-three/fiber@^9.4.0` - `wgpu-matrix@^3.0.2` Caret ranges allow future package releases within the permitted semantic-version range to be selected without changes to the documented command. Those future releases have not necessarily been reviewed with the Skill. The `--legacy-peer-deps` option instructs npm to ignore peer-dependency compatibility enforcement. This can conceal dependency conflicts and produce a dependency graph different from the tested configuration, even though the document describes the listed versions as locked and tested together. There is no evidence in the audited repository that these named packages are currently malicious. The vulnerability is the non-reproducible and weakened installation process. ### Attack Path 1. A dependency maintainer account or publication pipeline is compromised, or an unsafe future release is published within an allowed caret range. 2. A developer follows the documented command after that release becomes available. 3. npm resolves the newer package because it satisfies the caret range. 4. `--legacy-peer-deps` suppresses peer-dependency conflicts that could otherwise stop or warn against the selected graph. 5. Package installation scripts, build integrations, or imported runtime code execute in the developer or application environment. 6. Malicious or incompatible code gains access to resources available to the build process or generated application. ### Impact Assessment A compr ...[truncated 684 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version without caret or tilde ranges. 2. Commit the generated lockfile and use `npm ci` for deterministic installations. 3. Resolve peer-dependency conflicts explicitly instead of using `--legacy-peer-deps`. 4. If the flag is temporarily unavoidable, document the exact conflict, affected packages, risk acceptance, and removal plan. 5. Enable automated dependency vulnerability and provenance scanning in CI. 6. Require manual review for lockfile changes and native dependency updates. 7. Verify package signatures, registry provenance, and integrity metadata where supported. 8. Restrict install-script permissions in development and CI environments and disable unnecessary lifecycle scripts. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/frontend/expo-native-ui .cursor/skills/expo-native-ui
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/frontend/expo-native-ui .claude/skills/expo-native-ui
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/frontend/expo-native-ui ~/.claude/skills/expo-native-ui
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: expo-native-ui
model: standard
version: 1.0.0
description: >
  Build beautiful native iOS/Android apps with Expo Router. Covers route structure,

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx clawhub@latest install expo-native-ui`, which pulls and executes remote code at install time without a fixed version. Even though this is a common convenience pattern, it creates a supply-chain risk: a compromised package, tag, or dependency could execute arbitrary code on the user's machine.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 78% confidence
• Finding: `npx expo start` invokes a package resolver/executor path that may fetch or run a non-pinned toolchain depending on the local environment. In a skill document, recommending `npx` execution without version pinning increases reproducibility and supply-chain risk if the resolved package is unexpected or compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 78% confidence
• Finding: `npx expo run:ios` similarly relies on executing a potentially unpinned CLI tool, which can expose users to supply-chain compromise or inconsistent behavior across environments. Because this command can trigger build steps and native tooling interactions, a malicious or substituted package could have significant local impact.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

## Best Practices

- Always use SF Symbols over vector icon libraries
- Match symbol weight to nearby text weight
- Use `.fill` variants for selected/active states
- Use PlatformColor for tint to support dark mode

• Confidence: 70% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guidance explicitly recommends requesting camera permission eagerly, which can normalize asking for sensitive access before clear user intent is established. In a mobile app skill focused on camera features, this can lead developers to build privacy-invasive flows that over-collect permissions, reduce meaningful consent, and increase the chance of unnecessary access to the device camera.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes a skill focused on Expo Router, native tabs, animations, blur effects, liquid glass, SF Symbols, and platform UI patterns. This document instead positions the skill for 'ANY 3D graphics, games, GPU compute, or Three.js features,' which is a materially different capability area from native UI guidance.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest presents the skill as a native UI helper, but this file adds advanced graphics-stack setup including WebGPU dependencies and installation instructions. GPU compute and low-level rendering setup are not obvious implementation details of Expo Router or native UI patterns; they expand the skill into graphics-engine configuration.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The instruction says to use this skill for "ANY 3D graphics, games, GPU compute, or Three.js features in React Native," which defines activation scope very broadly without boundaries or exclusion conditions. In a markdown skill reference, this can cause unintended invocation for a wide range of loosely related React Native requests.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Line L003 states 'Never use FontAwesome or Ionicons,' which is an absolute prescriptive instruction. This enforces a single implementation choice without indicating whether exceptions, user preference, or project constraints are allowed, which can constitute an unnecessary policy-like restriction in natural-language guidance.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The phrase 'Never use AsyncStorage' is an unconditional natural-language directive that imposes a fixed technology choice without any stated exception, user opt-in, or contextual limitation. This fits the policy-violation category's concern about forcing a specific choice via natural-language instruction, even though it is framed as storage guidance rather than a user-selectable option.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The phrase "Always prefer NativeTabs" is a natural-language directive that enforces a single implementation choice universally. This can be interpreted as a policy-style mandate without offering user choice or context-based exceptions, which may conflict with guidance requiring opt-in or justified constraints.

Static analysis

No suspicious patterns detected.