expo/skills

Evaluate Expo skills in this repo end-to-end - trigger accuracy, generated code quality, and runtime screenshots on iOS simulator and Android emulator via Expo Go (web optional). Use when the user wants to eval an Expo skill, test that a skill produces working code, benchmark a skill with device screenshots, or verify a skill's output renders correctly.

Content hash

sha256:f3d3259c985b15bae3534c52fb7ec94e9278a2409ec7d928b95ecf516cc1a01d

Files

13

Quality

100/100

Security findings

• highDisables agent safety promptsSL602 · .claude/skills/expo-skill-eval/SKILL.md:79
  - **Skip permissions (recommended)** — pass `--dangerously-skip-permissions`. Each subprocess runs unattended inside a throwaway fixture under `/private/tmp/ex…

  The skill turns off the agent's permission checks. Fix: Remove the flag. Let the user decide which tools run without confirmation.

• highDisables agent safety promptsSL602 · .claude/skills/expo-skill-eval/SKILL.md:193
  - A permission flag, confirmed with the user up front (see **Before starting — clarify scope**): either `--dangerously-skip-permissions` or `--permission-mode …

  The skill turns off the agent's permission checks. Fix: Remove the flag. Let the user decide which tools run without confirmation.

• lowDisables agent safety promptsSL602 · .claude/skills/expo-skill-eval/SKILL.md:77
  **Confirm how `claude -p` subprocesses run — once, before starting.** Ask with `AskUserQuestion` whether they may run with `--dangerously-skip-permissions`, th…

  The skill turns off the agent's permission checks. Fix: Remove the flag. Let the user decide which tools run without confirmation. Severity lowered: the line reads as documentation, not an instruction.

• lowDisables agent safety promptsSL602 · .claude/skills/expo-skill-eval/SKILL.md:159
  Run each query's subprocess from an empty throwaway cwd (e.g. `trigger-evals/scratch/`), not the repo root. A should-trigger prompt like "build me a settings s…

  The skill turns off the agent's permission checks. Fix: Remove the flag. Let the user decide which tools run without confirmation. Severity lowered: the line reads as documentation, not an instruction.

Deploy Expo websites and Expo Router API routes to EAS Hosting - export the web bundle, run eas deploy for production and PR preview URLs, manage environment secrets and custom domains, and work within the Cloudflare Workers runtime. Also covers authoring API routes (+api.ts handlers, HTTP methods, request handling, CORS). Use when deploying an Expo web app or API routes, setting up EAS Hosting, or configuring hosting environments and domains. Not for native builds or store releases - use the eas-app-stores skill for those.

Content hash

sha256:acc85740f366dd3c4563a7ff627dcb9f6c19853bef9fff100a514fc86cafc498

Files

2

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/eas-hosting/SKILL.md:12
  EAS Hosting deploys your Expo **web app and API routes** to Expo's managed edge (Cloudflare Workers). Export the web bundle with `npx expo export -p web` and s…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/eas-hosting/SKILL.md:207
  npx expo serve

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/eas-hosting/SKILL.md:224
  npm install -g eas-cli

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/eas-hosting/SKILL.md:234
  npx expo export -p web

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

Run and control a user's app on a remote iOS/Android simulator hosted on EAS cloud. Read before running any `eas simulator:*` commands - it has the current syntax for this experimental API. Use whenever the user needs a simulator they can't run locally - 'run my app on a cloud simulator', 'use eas simulator to run/install/screenshot my app', 'I'm on Linux/Cursor and need an iOS device', 'no sim on this box / headless CI', 'let an agent click through my app and screenshot it', 'test my dev build on a remote sim with live reload', 'stream a sim to my browser' - even when they don't say 'EAS Simulator' or 'cloud'. On a host WITHOUT a local simulator (Linux, CI, cloud sandbox) it's the default; on macOS, do NOT auto-trigger for a plain 'run on the simulator' - use it only for a cloud/remote/shareable sim, an iOS version they lack, or an agent-driven session. NOT for local sims (expo run:ios, Xcode, Android Studio), EAS Build/Update, web preview, or physical devices.

Content hash

sha256:03d03d90054126553aa0b1b99c2e07a73b711ce4ba96eb2aa817feda62f94bd1

Files

6

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/eas-simulator/SKILL.md:35
  - Run from an Expo **project directory.** A fresh app needs one-time setup: `npx --yes eas-cli@latest init` to create/link the project (when there's no `projec…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowHides actions from the userSL102 · plugins/expo/skills/eas-simulator/references/run-your-app.md:230
  **Carry authorization through the whole development loop.** When the user's existing authorization covers this project's EAS Simulator live development and req…

  The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-simulator/SKILL.md:6
  allowed-tools: "Bash(npx *eas-cli@*), Bash(npx *agent-device@*), Bash(npx expo *), Bash(eas *), Bash(expo *), Bash(xcodebuild*), Bash(pod*), Bash(argent *), Ba…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-simulator/references/controllers.md:107
  npm install -g @swmansion/argent

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-simulator/references/run-your-app.md:76
  npx expo prebuild --platform ios # set ios.bundleIdentifier in app.json first to avoid prompts

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-simulator/references/run-your-app.md:149
  - **Local (Mac):** `npx expo install expo-dev-client`; `npx expo prebuild --platform ios --clean` (set `ios.bundleIdentifier` first); `( cd ios && LANG=en_US.U…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-simulator/references/run-your-app.md:158
  EXPO_UNSTABLE_TUNNEL_V2=1 npx expo start --tunnel --port <your-free-port> # background it durably

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-simulator/references/troubleshooting.md:13
  | `prebuild`/`eas build` prompts for or fails on a missing **iOS bundle identifier** | A fresh app often has no `ios.bundleIdentifier` | Set it in app config (…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Expo's official example projects - the expo/examples repo of ~70 `with-*` integrations (Stripe, Clerk, Supabase, OpenAI, maps, Reanimated, SQLite, Skia, NativeWind, and more). Use when integrating a third-party library or service into an existing Expo app and you want the canonical, version-matched pattern to adapt, or when scaffolding a new project from one with `npx create-expo --example`.

Content hash

sha256:1ac804cb03fc1d72c0b9bbacfe59572181926d92d3866107962f1f7eda5854e4

Files

3

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/expo-examples/SKILL.md:3
  description: Expo's official example projects - the expo/examples repo of ~70 `with-*` integrations (Stripe, Clerk, Supabase, OpenAI, maps, Reanimated, SQLite,…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-examples/SKILL.md:57
  npx degit expo/examples/with-stripe /tmp/expo-ref/with-stripe # clean copy, no git history

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-examples/SKILL.md:68
  npx create-expo --example with-stripe # short form: npx create-expo -e with-stripe

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-examples/agents/openai.yaml:4
  default_prompt: "Use $expo-examples when integrating a third-party library or service into an Expo app to find the canonical with-* example to adapt, or to sca…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• infoUnpinned package installSL501 · plugins/expo/skills/expo-examples/SKILL.md:76
  - **Version-align — don't copy pinned versions.** Examples track the **latest** SDK, so their `package.json` pins won't match an older project. Add only the *m…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-examples/references/catalog.md:5
  Use any name with `npx create-expo --example <name>` (scaffold) or inspect it via `gh api repos/expo/examples/contents/<name>/<file>`.

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Guidelines for upgrading Expo SDK versions and fixing dependency issues

Content hash

sha256:f9fc924d5fe4451ed21771ee728a8015871355faab94dfbd2c799accc452bbb4

Files

9

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/SKILL.md:25
  npx expo install expo@next --fix # install beta

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/SKILL.md:35
  npx expo install expo@latest

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/SKILL.md:36
  npx expo install --fix

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/SKILL.md:44
  npx expo export -p ios --clear

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/SKILL.md:64
  npx expo prebuild --clean

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/SKILL.md:74
  - Clear derived data for Xcode: `npx expo run:ios --no-build-cache`

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• infoUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/references/new-architecture.md:54
  npx expo install react-native-worklets

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/references/new-architecture.md:76
  1. **Clear caches** — `npx expo start --clear`

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/references/new-architecture.md:77
  2. **Clean prebuild** — `npx expo prebuild --clean`

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/references/react-compiler.md:56
  2. Clear Metro cache: `npx expo start --clear`

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/references/react-navigation-to-expo-router.md:18
  npx expo-codemod sdk-56-expo-router-react-navigation-replace src

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-upgrade/references/react-navigation-to-expo-router.md:22
  npx expo-codemod sdk-56-expo-router-react-navigation-replace '**/*.{ts,tsx,js,jsx}'

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Build and submit iOS and Android apps with EAS to TestFlight, the App Store, or Google Play. Supports Expo and other React Native projects, plus existing native apps. Use for eas.json setup, release pipelines, signing, app versions and build numbers, store submissions, and listing metadata. For Expo websites and API routes, use eas-hosting; for adding React Native screens to a native app, use expo-brownfield.

Content hash

sha256:18d0503a4dac8ec7176f45ee91e236d84f338a1149bc717c9d194b1efbdab0aa

Files

8

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/eas-app-stores/SKILL.md:39
  npm install -g eas-cli

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/eas-app-stores/SKILL.md:76
  npx testflight

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/eas-app-stores/SKILL.md:81
  Deploying an Expo website or Expo Router API routes to EAS Hosting (`npx expo export -p web` then `eas deploy`) is covered by the `eas-hosting` skill. This ski…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• infoUnpinned package installSL501 · plugins/expo/skills/eas-app-stores/references/ios-app-store.md:87
  npx testflight

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Build beautiful, native-feeling Expo screens. Covers Apple HIG styling, semantic colors, native controls, SF Symbols, media, visual effects, gradients, storage, and responsive layout. For routing and navigation, use the expo-router skill; for motion and animation, use the expo-animation skill.

Content hash

sha256:8442fad055c84846bef309885b7a12620b8f20d4f3514941fafdad58428576bc

Files

9

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/expo-native-ui/SKILL.md:33
  Most Expo apps work in Expo Go without any custom native code. Before running `npx expo run:ios` or `npx expo run:android`:

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-native-ui/SKILL.md:35
  1. **Start with Expo Go**: Run `npx expo start` and scan the QR code with Expo Go

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-native-ui/SKILL.md:41
  You need `npx expo run:ios/android` or `eas build` ONLY when using:

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• infoUnpinned package installSL501 · plugins/expo/skills/expo-native-ui/references/webgpu-three.md:500
  npx expo prebuild

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-native-ui/references/webgpu-three.md:501
  npx expo run:ios

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Configure and use EAS Update for over-the-air JavaScript and asset updates with expo-updates and EAS CLI. Use when setting up OTA updates, running eas update:configure or eas update, publishing to preview/staging/production channels, explaining branches/channels/runtime versions, testing updates, or debugging why an installed build still shows old code. Load for TestFlight, preview, or production updates that do not appear, including questions about cold launches or reopening the app. Not for update health metrics; use eas-update-insights for adoption, crashes, and rollout monitoring.

Content hash

sha256:cdc1361dcd0b74ee6c81ae5cfc92ea4118b05a001a34d73ba625cb67e01a50b2

Files

2

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/eas-update/SKILL.md:29
  npx expo install expo-updates

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• infoUnpinned package installSL501 · plugins/expo/skills/eas-update/SKILL.md:6
  allowed-tools: "Bash(npx expo *), Bash(npx *eas-cli@*), Bash(eas *)"

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades. Writes the implementation with Reanimated, Gesture Handler, Expo Router and expo-haptics. Use when animating anything in an Expo app, adding gestures, sheets, screen transitions, press feedback or haptics, or fixing motion that stutters on device. For web animation use `animate`.

Content hash

sha256:06b67166d9249f80b1ce476dd55ee0b44e47568b421a467768cd0c6f99c02a82

Files

4

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/expo-animation/SKILL.md:80
  **Dependencies.** Install with `npx expo install <package>` — it resolves the version that matches the project's SDK, which plain `npm install` won't:

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• lowUnpinned package installSL501 · plugins/expo/skills/expo-animation/SKILL.md:212
  - Install through Expo so versions match the SDK: `npx expo install react-native-reanimated react-native-worklets`. In an Expo project, `babel-preset-expo` con…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

• infoUnpinned package installSL501 · plugins/expo/skills/expo-animation/RECIPES.md:10
  npx expo install react-native-reanimated react-native-worklets react-native-gesture-handler expo-haptics

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-animation/RECIPES.md:258
  npx expo install react-native-keyboard-controller

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Add an iOS App Clip target to an Expo app. Use when the user mentions App Clip, AASA, apple-app-site-association, appclips, smart app banner, or wants to ship a lightweight iOS Clip invoked from a URL alongside their parent app.

Content hash

sha256:cfa065ad1d2308df392f461578a852b19456bda78ae343ea4f2a92600d21deb3

Files

3

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/expo-app-clip/SKILL.md:188
  npx expo config --type introspect

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

Build and distribute Expo development clients locally or via TestFlight for internal testing. For production TestFlight releases and store submission, use the eas-app-stores skill.

Content hash

sha256:65c3e7d2353482dbab45afab4421a8d05b0e23729d9b28957eb3406c97ab5f51

Files

2

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/expo-dev-client/SKILL.md:150
  npx expo start --dev-client

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

Entry point and router for every Expo or EAS task. Load this skill first — before writing code and before choosing another expo-* / eas-* skill — when the request, PRD, or spec mentions Expo, EAS, Expo Go, or an expo-* package, or the project has an `expo` dependency in `package.json`. Within that gate it also covers app specs and designs to implement (tabs, stacks, maps, lists, navigation, building from a screenshot), and phrasings like 'implement a mobile app', 'make my app look native', 'add navigation', 'fetch some data', 'upgrade my SDK', 'add Expo to my existing native app', 'ship to the App Store', or 'I'm new to Expo, where do I start'. A fully specified request (SDK pinned, libraries named, layout given) still routes through here — the shared setup rules still apply. Do NOT load it when neither signal is present: a bare React Native project with no `expo` dependency is not Expo work. Detects the real goal, routes to the right expo-* / eas-* skill, and owns the shared setup rules.

Content hash

sha256:91db7ed659c93d4c529d0ffa858f005c12ffce9bf6ee1aa3046bb31c7d738420

Files

3

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/expo-overview/SKILL.md:95
  - **Install packages with `npx expo install <pkg>`**, not raw `npm`/`yarn`/`pnpm add`,

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

Submit feedback on an Expo skill—or Expo itself—and control bundled anonymous usage telemetry (off by default / opt-in). Submit feedback with: npx --yes submit-expo-feedback@latest "ACTIONABLE_FEEDBACK". Optionally add either or both: --category "CATEGORY" and --subject "SUBJECT". Replace the uppercase placeholders before running. Use when a skill was useful, confusing, broken, missing context, or worth improving; when Expo, Expo CLI, EAS CLI, docs, or MCP worked well or fell short; when an AI agent repeatedly failed, got stuck, or needed the user to take over an Expo task (report it as an eval candidate); or when the user explicitly asks to enable or disable telemetry (tracking), check its status, or understand what it collects.

Content hash

sha256:5a1337fefc81f7481151b4562d0d066961abd509f45dbc414f160de8c325cab5

Files

5

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/expo-skill-feedback/SKILL.md:31
  | `expo-cli` | Full Expo CLI command, such as `npx expo install` |

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

Build native UI with the @expo/ui package: real SwiftUI on iOS and Jetpack Compose on Android. Default to @expo/ui for sheets (BottomSheet), pickers, sliders, toggles, menus, and grouped-form sections — do NOT reach for Reanimated, @gorhom/bottom-sheet, or RN built-in Picker/Switch; use @expo/ui instead. Fall back to RN built-ins only when @expo/ui is missing the component. NOTE: @expo/ui List renders native grouped rows like an iOS Settings screen — it is NOT a virtualized list; use FlatList/FlashList for large datasets. Covers universal components (Host, Column, Row, Button, Text, List, BottomSheet, FieldGroup, Switch, Slider, Picker, Menu), drop-in replacements for RN community libraries, and platform-specific SwiftUI/Jetpack Compose trees. Not for Expo Router navigation, Reanimated, or data fetching.

Content hash

sha256:96a40c387f3080bd601efc69a09a42106ee2da39541cebfa6545d0f7752c7b61

Files

7

Quality

100/100

Security findings

• lowUnpinned package installSL501 · plugins/expo/skills/expo-ui/SKILL.md:18
  npx expo install @expo/ui

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

Use for anything related to EAS Observe - adding `expo-observe` to an Expo project (AppMetricsRoot/ObserveRoot HOC, markInteractive and ObserveInteractiveMarker, the useObserve hook, the Expo Router / React Navigation integrations for per-route metrics, user-defined events via `Observe.logEvent`, error reporting via ObserveErrorBoundary and `Observe.reportError`, native crash reporting, source map upload for symbolicated stack traces, and runtime config such as sampleRate and dispatchInDebug), querying via the EAS CLI (`eas observe:metrics-summary`, `observe:metrics`, `observe:routes`, `observe:events`, `observe:session`, `observe:versions`, `observe:errors`, `observe:event`), interpreting the resulting metrics (cold/warm launch, TTR, TTI, navigation cold/warm TTR, update download, and the TTI frameRate/device/network params for triaging slow startups), or shipping an Observe integration inside a third-party package.

Content hash

sha256:c5b0d3728655f18f2e4c6049f52b6f1d95bb9486af890773ea1eee7d584e117a

Files

6

Quality

100/100

Security findings

• infoUnpinned package installSL501 · plugins/expo/skills/eas-observe/references/setup.md:24
  2. **Expo SDK 55 or later.** Run `npx expo-doctor` to check, and `npx expo install --fix` to update dependencies. SDK 56+ unlocks the newer `ObserveRoot` / `us…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-observe/references/setup.md:33
  npx expo install --fix

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-observe/references/setup.md:34
  npx expo install expo-observe

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-observe/references/setup.md:517
  The URL is baked into the native layer at build time, so run `npx expo prebuild` and rebuild after changing it. If the backend expects standard OTLP paths with…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/eas-observe/references/setup.md:522
  - [ ] `expo-observe` installed via `npx expo install`.

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Check the health of published EAS Update: crash rates, install/launch counts, unique users, payload size, and the split between embedded and OTA users per channel. Use when the user asks how an update is performing, whether a rollout is healthy, how many users are on the embedded build vs OTA, or wants to gate CI on update health.

Content hash

sha256:6dc5e45558e35efe6391c23932a3e5274e05c8bfdce45af76ef9684c63c96a3d

Files

4

Quality

100/100

Security findings

None of the 30 rules matched.

Helps understand and write EAS workflow YAML files for Expo projects. Use this skill when the user asks about CI/CD or workflows in an Expo or EAS context, mentions .eas/workflows/, or wants help with EAS build pipelines or deployment automation.

Content hash

sha256:65211cee654946abee3f4e5dfb3c7326c1f2cae2a0c893a9a7da09b873fe4709

Files

4

Quality

100/100

Security findings

None of the 30 rules matched.

Integrate Expo and React Native into an existing native iOS or Android app. Use for brownfield, embedding a React Native screen in SwiftUI/UIKit or Kotlin, or AAR/XCFramework packaging. Covers isolated and integrated approaches. For building or distributing a purely native app with EAS, use eas-app-stores.

Content hash

sha256:4e908b2079639b5138c73a1ec1e05c4fc7a19f4bd0d138850ab422817988b237

Files

8

Quality

100/100

Security findings

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/SKILL.md:55
  For an existing Expo/RN project, keep its selected SDK and use `npx expo install` to align dependencies. Do not upgrade it just to follow this skill. For a new…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-integrated.md:31
  For TypeScript, install `typescript` and `@types/react` with `npx expo install`, then use the explicit entry point in [feature integration](./feature-integrati…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:47
  npx expo install expo-brownfield

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:95
  SDK 57 enables precompiled Expo modules by default. For a supported SDK where an explicit opt-in is needed, install `expo-build-properties` with `npx expo inst…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:117
  npx expo-brownfield build:android

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:170
  npx expo-brownfield build:android --task publishReleasePublicationToCompanyRepository

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:171
  npx expo-brownfield tasks:android # list available publish tasks and repositories

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:181
  npx expo-brownfield build:android --fused --repo MavenLocal

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:208
  npx expo-brownfield build:ios

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:240
  npx expo-brownfield build:ios --release --package MyAppPackage

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:248
  npx expo-brownfield build:ios --debug --artifacts ./artifacts-debug --package MyAppPackage

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:249
  npx expo-brownfield build:ios --release --artifacts ./artifacts-release --package MyAppPackage

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:259
  npx expo prebuild

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:434
  npx expo start

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/brownfield-isolated.md:437
  Build a Debug artifact (`npx expo-brownfield build:ios --debug` on iOS), select it in the host, then build and run the native app in Debug. React Native screen…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/comparison.md:33
  | Re-publish workflow for RN changes | `npx expo-brownfield build:*` then bump the dependency | Rebuild the native app …

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/feature-integration.md:13
  For a small standalone producer, set `package.json`'s `main` to `index.ts` and register a component explicitly. If the scaffold has no TypeScript setup, first …

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/troubleshooting.md:11
  - **Integrated approach:** keep the hand-maintained host intact. Run `npx expo install --check` in the JS project, apply SDK-matched native template changes se…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/troubleshooting.md:20
  - Install with `npx expo install <package>` rather than plain `yarn add` — `expo install` picks the version compatible with the current SDK.

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/troubleshooting.md:22
  - For the **isolated approach**, you must re-run `npx expo-brownfield build:android|ios` after adding a module, and republish/re-embed the new artifact.

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/troubleshooting.md:30
  - Confirm Metro is actually running: `npx expo start` from the Expo project (or `yarn start` from the workspace root).

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/troubleshooting.md:79
  - Re-run `npx expo install --fix` in the Expo project to align native module versions.

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/version-compatibility.md:10
  4. Use that SDK's versioned Brownfield API docs and `sdk-<major>` native template. Install modules with `npx expo install`; run `npx expo install --check` befo…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-brownfield/references/version-compatibility.md:18
  npx expo install expo-brownfield typescript @types/react

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Use when implementing or debugging ANY network request, API call, or data fetching. Covers fetch API, React Query, SWR, error handling, caching, offline support, loading/empty/error screen states, and Expo Router data loaders (`useLoaderData`).

Content hash

sha256:9eca65821cd82bca1813366710ade412907dd1b0a2916f9111ce81863c16b4e5

Files

4

Quality

100/100

Security findings

• infoUnpinned package installSL501 · plugins/expo/skills/expo-data-fetching/references/expo-router-loaders.md:14
  **Requirements:** Expo SDK 55+, web output mode (`npx expo serve` or `npx expo export --platform web`) set in `app.json` or `app.config.js`.

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-data-fetching/references/expo-router-loaders.md:318
  | **When loader runs** | Every request (live) | At build time (`npx expo export`) |

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Build and maintain a design system inside an Expo app - a reusable theme of design tokens (color, spacing, typography, radius, shadow, motion), reusable component structure with variant/size/state prop conventions, and rules for when to extract a repeated view into a shared component. Use when creating or organizing theme files and design tokens (theme.ts / theme/), extending an existing theme or styling library (NativeWind, Tamagui, Restyle, Unistyles) in its own idiom, standardizing styles so screens (including AI-generated ones) look consistent and polished, fixing an app that looks AI-generated or generic instead of native (the named native-slop tells), building an in-app component library, or auditing an app for design-system drift (hardcoded colors, spacing, fonts). For platform styling specifics (semantic colors, HIG rules, native controls) use expo-native-ui; for folder layout of a new app use expo-project-structure.

Content hash

sha256:7ee63b03e1f7e08ec95f9bfeb682904e0d39bdaed7b1cc4e6fcf0cf98730aec0

Files

4

Quality

100/100

Security findings

None of the 30 rules matched.

Use Expo DOM components to run web code in a webview on native and as-is on web. Migrate web code to native incrementally. For the end-to-end migration of a whole web app, use the expo-web-to-native skill.

Content hash

sha256:e22e0a0e4b2a1e36764587252bfc42fd8038254052c0147b584022a7f1bfeeec

Files

2

Quality

100/100

Security findings

None of the 30 rules matched.

Guide for creating and writing Expo native modules and views using the Expo Modules API (Swift, Kotlin, TypeScript). Covers module definition DSL, native views, shared objects, config plugins, lifecycle hooks, autolinking, and type system. Use when building or modifying native modules for Expo. Not for migrating an existing Swift module from the definition DSL to the Expo Modules API 2.0 macros; use expo-migrate-module (from the expo-experiments plugin) for that.

Content hash

sha256:411a6c4d58269da043986763e8dd240168c0ba6688a41c952a8956526c658a74

Files

8

Quality

100/100

Security findings

• infoUnpinned package installSL501 · plugins/expo/skills/expo-module/references/config-plugin.md:3
  Config plugins customize native Android and iOS projects generated with `npx expo prebuild`. They are synchronous functions that accept an `ExpoConfig` and ret…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-module/references/config-plugin.md:90
  - Test with `npx expo prebuild --clean`

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Folder structure for a new Expo app. Use when scaffolding or laying out a new Expo project with Expo Router, or deciding where a file should live in one. For new projects only — never restructure an existing app to match.

Content hash

sha256:a8d5cd74f3a0cbcf26e577a0006e01788238bea7ee75e4dc0f48019bbf2ae1d4

Files

2

Quality

100/100

Security findings

None of the 30 rules matched.

Navigation and routing for Expo Router. Covers file-based routes, groups and dynamic routes, folder organization, Link with previews and context menus, native Stack, page titles, modals and form sheets, NativeTabs, headers and toolbars, and header search bars.

Content hash

sha256:6bc9c34deec6c19a9196ff1ba914c351ccca2fa6a81ac89741c7d26253bdc46d

Files

8

Quality

100/100

Security findings

None of the 30 rules matched.

Migrate an existing web React app to a native iOS/Android app with Expo. Use when the user wants to turn a website into a mobile app, port a Next.js/Vite/CRA React codebase to React Native, reuse web code on native incrementally, or asks how web idioms (the DOM, CSS, React Router, localStorage, window) map to native. This is the end-to-end migration guide; use the `expo-dom` skill for the DOM-component mechanism itself.

Content hash

sha256:45bdf75d4937f8c7969efa45566c5bbd8274acd4cd07d4940721f416941d2c15

Files

6

Quality

100/100

Security findings

• infoUnpinned package installSL501 · plugins/expo/skills/expo-web-to-native/references/verify-on-device.md:32
  1. Run the app: `npx expo start --ios` (Expo Go). To keep the onboarding sheet, dev menu, and Tools button out of your screenshots on SDK 57 and earlier, and o…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · plugins/expo/skills/expo-web-to-native/references/verify-on-device.md:37
  > **Android:** `simctl` / `expo run:ios` are iOS-only. Use an Android emulator + `adb` — `adb exec-out screencap -p > native.png`, `adb shell am start -a andro…

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Migrate an existing Apple/Swift Expo native module from the Expo Modules API 1.0 definition DSL to the 2.0 macro API (sometimes called v2) while preserving its JavaScript and TypeScript contract. Use when converting or incrementally adopting @ExpoModule, @JS, @Event, @SharedObject, or @Record in an existing module. Do not use for creating a new module, general Expo SDK upgrades, or Android/Kotlin migrations.

Content hash

sha256:37f6b5ea1301f97a666c0e4a55d7234c26902173734831ebc49d422886ab0c16

Files

5

Quality

100/100

Security findings

None of the 30 rules matched.