expo-skills — agentic threat model

Not certain from the listing — The underlying LLM is not specified, but it is susceptible to prompt injection that could trick the agent into running malicious Expo CLI commands or EAS build configurations.

Not certain from the listing — The agent relies on Expo-specific documentation and local project files. If local project files or dependency manifests are poisoned, the agent may ingest malicious context.

The agent orchestrates Expo-specific workflows and runs bundled tooling/commands. The primary threat is tool misuse or insecure tool integration, where malicious inputs trigger unintended local shell commands or EAS API calls.

Not certain from the listing — The agent runs bundled tooling, which likely executes in the user's local terminal or CI/CD environment. Without strict sandboxing, this poses a risk of local host compromise or unauthorized EAS credential access.

Not certain from the listing — There is no mention of built-in guardrails, logging, or execution monitoring to intercept harmful commands before they are executed in the Expo project context.

The agent interacts with EAS (Expo Application Services), which requires authentication tokens. Insecure handling of these secrets within the agent's execution context could lead to credential exfiltration.

As an open-source collection of skills, these can be integrated into broader multi-agent developer workflows, creating risks of cascading failures if a upstream agent passes untrusted code to these skills.