expo-cicd-workflows
Verdict safe, but 2 findings (2 medium), mainly data exfiltration, prompt injection. Most recent scan 2026-02-06.
This Expo CI/CD workflow skill has MEDIUM overall security risk. The primary concerns are: (1) Transitive trust in external documentation and schema resources from api.expo.dev and GitHub without integrity verification, creating indirect prompt injection risks if those sources are compromised, (2) Missing script files that are referenced in instructions, preventing verification of their security controls, (3) Potential for resource exhaustion in validation operations. The skill's core functionality (generating CI/CD workflows) is legitimate, but the reliance on external, unverified content for critical schema and documentation creates a supply chain risk. The skill would benefit from integrity verification of external resources, inclusion of missing scripts for review, and more defensive validation patterns.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Helps understand and write EAS workflow YAML files for Expo projects. Use this skill when the user asks about CI/CD or workflows in an Expo or EAS context, mentions .eas/workflows/, or wants help with EAS build pipelines or deployment automation.
- Package
- 4 files, 8.6 KB
- SKILL.md
- 422 words, 10 sections
- Code
- JavaScript (2)
- Allowed tools
ReadWriteBash(node:*)- License
- MIT License
- Version
- 1.0.0
SKILL.md covers: EAS Workflows Skill · Reference Documentation · Fetch resources · Workflow File Location · Top-Level Structure · Expressions · Generating Workflows · Validation · Install dependencies if missing · Answering Questions
Findings
MEDIUM Hardcoded External API Endpoint Without Validation Data Exfiltrationllm
The skill fetches external resources from api.expo.dev and raw.githubusercontent.com without any validation or integrity checks. While these are legitimate Expo domains, the skill trusts the content implicitly and uses it to generate workflow files that will execute in CI/CD pipelines. An attacker compromising these endpoints or performing a man-in-the-middle attack could inject malicious schema definitions or documentation that leads to unsafe workflow generation.
SKILL.md
```bash
node {baseDir}/scripts/fetch.js <url>
```
Fetches from:
1. https://api.expo.dev/v2/workflows/schema
2. https://raw.githubusercontent.com/expo/expo/refs/heads/main/docs/pages/eas/workflows/syntax.mdx
3. https://raw.githubusercontent.com/expo/expo/refs/heads/main/docs/pages/eas/workflows/pre-packaged-jobs.mdxMEDIUM Transitive Trust in External Documentation Content Prompt Injectionllm
The skill instructs the agent to fetch and follow external documentation from GitHub (syntax.mdx, pre-packaged-jobs.mdx) without any content validation. The instruction explicitly states 'Do not rely on memorized values; these resources evolve as new features are added.' This creates a transitive trust relationship where the agent will follow whatever instructions or examples are present in the external markdown files. If these files were compromised or contained malicious examples, the agent would incorporate them into generated workflows.
SKILL.md
```markdown
2. **Syntax Documentation** — https://raw.githubusercontent.com/expo/expo/refs/heads/main/docs/pages/eas/workflows/syntax.mdx
- Overview of workflow YAML syntax
- Examples and English explanations
3. **Pre-packaged Jobs** — https://raw.githubusercontent.com/expo/expo/refs/heads/main/docs/pages/eas/workflows/pre-packaged-jobs.mdx
Do not rely on memorized values; these resources evolve as new features are added.
```What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 3.4 KB |
scripts/fetch.js | script | 2.9 KB |
scripts/package.json | config | 204 B |
scripts/validate.js | script | 2.1 KB |
External hosts referenced
api.expo.dev raw.githubusercontent.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit b631a6045b42. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/expo/skills
- Raw scan result: expo-cicd-workflows-scan.json
- Badge for your README:
- Request a re-scan