Audit candidate: expo/skills

[xiaolai]

Repo

https://github.com/expo/skills

Field	Value
Stars	1784
NL Artifacts	14
Discovery strategy	awesome-list-citation
Cited by: awesome-claude-code, awesome-claude-skills

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts

[github-actions]

Audit Complete: expo/skills

NL Score: 92/100 | Security: CLEAR | Artifacts: 15 | Strategy: single

NLPM Audit: expo/skills

Date: 2026-04-26 | Artifacts: 15 | Strategy: single
NL Score: 92/100
Security: CLEAR
Bugs: 2 | Quality Issues: 9 | Security Findings: 4

NL Score Summary

File	Type	Score	Top Issue
CLAUDE.md	project-doc	80	Outdated repo structure docs; describes split plugins that don't exist
plugins/expo/skills/expo-ui-swift-ui/SKILL.md	skill	80	Import path mismatch (@expo-ui/swift-ui vs @expo/ui/swift-ui); name not kebab-case
plugins/expo/skills/expo-deployment/SKILL.md	skill	85	Inconsistent reference paths: top section uses references/, body uses reference/
plugins/expo/skills/expo-ui-jetpack-compose/SKILL.md	skill	88	Name field not kebab-case ("Expo UI Jetpack Compose"); SDK 55–only scope undisclosed in description
plugins/expo/skills/expo-cicd-workflows/SKILL.md	skill	91	{baseDir} placeholder in commands not documented; unclear if auto-substituted
plugins/expo/skills/building-native-ui/SKILL.md	skill	92	Four vague quantifiers: "almost always" ×2, "Whenever possible", "frequently"
plugins/expo/skills/upgrading-expo/SKILL.md	skill	93	Clean; minor formatting nits
plugins/expo/.claude-plugin/plugin.json	manifest	95	Well-formed; no issues
plugins/expo/skills/expo-dev-client/SKILL.md	skill	95	Clean
plugins/expo/skills/expo-tailwind-setup/SKILL.md	skill	95	Clean
plugins/expo/skills/use-dom/SKILL.md	skill	95	Clean
plugins/expo/skills/expo-api-routes/SKILL.md	skill	96	Vague instruction words: "focused", "gracefully"
plugins/expo/skills/native-data-fetching/SKILL.md	skill	96	Vague decision-tree labels: "Complex", "Simpler"
plugins/expo/skills/expo-module/SKILL.md	skill	97	Excellent
plugins/expo/skills/eas-update-insights/SKILL.md	skill	98	Excellent; model skill for the collection

Security Scan

Severity	Count
Critical	0
High	0
Medium	1
Low	3

Execution Surface Inventory

Surface	Files
Hooks	None
Scripts	plugins/expo/skills/expo-cicd-workflows/scripts/fetch.js, plugins/expo/skills/expo-cicd-workflows/scripts/validate.js
MCP configs	None
Package manifests	plugins/expo/skills/expo-cicd-workflows/scripts/package.json

Security Findings

#	Severity	File	Line	Pattern	Description
1	Medium	plugins/expo/skills/expo-cicd-workflows/scripts/fetch.js	96–107	Unvalidated URL arg passed to fetch	Script accepts any URL via process.argv[2] and makes an HTTP request without domain or scheme validation; SSRF if invoked with attacker-controlled input outside skill context
2	Low	plugins/expo/skills/expo-cicd-workflows/scripts/package.json	7	SEC-unpinned-semver	ajv@^8.17.1 — caret range allows minor/patch upgrades without lock-file pinning
3	Low	plugins/expo/skills/expo-cicd-workflows/scripts/package.json	8	SEC-unpinned-semver	ajv-formats@^3.0.1 — caret range
4	Low	plugins/expo/skills/expo-cicd-workflows/scripts/package.json	9	SEC-unpinned-semver	js-yaml@^4.1.0 — caret range

Bugs (PR-worthy)

---

Full report: https://github.com/xiaolai/nlpm-for-claude/blob/main/auditor/audits/expo-skills.md

4 bug(s) found. To submit fix PRs to the target repo, add the contribute-approved label to this issue.

[xiaolai]

Contribution run: expo/skills

Target: https://github.com/expo/skills
NL Score: 92/100 (15 artifacts)
Tracking issue: expo/skills#54

PRs Created

#	PR	Fix
1	expo/skills#50	Bug: correct @expo-ui/swift-ui → @expo/ui/swift-ui import path in expo-ui-swift-ui/SKILL.md
2	expo/skills#51	Bug: unify ./reference/ → ./references/ paths in expo-deployment/SKILL.md (5 occurrences)
3	expo/skills#52	Security (Medium): add URL allowlist to fetch.js to prevent SSRF
4	expo/skills#53	Security (Low): pin exact semver versions in package.json (ajv, ajv-formats, js-yaml)

[github-actions]

Exemplar published

Score 92/100 — added as a teaching artifact at auditor/exemplars/expo-skills.md.

Rules from skills/nlpm/rules/ can now cite this repo as a positive real-world example.

View exemplar