Skip to content
skillsafebeta
← Report library
Purpose / Other

Animate Expo Skill Security Audit

What the author says it does (original text)

Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades. Writes the implementation with Reanimated, Gesture Handler, Expo Router and expo-haptics. Use when animating anything in an Expo app, adding gestures, sheets

Independent security check

Do not install or run it yet

Files checked
2
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Low risk

Using the recipes may execute third-party dependency installation and alter project dependency state

Source references: 2
What we found

The Skill does more than generate source code: it explicitly directs use of `npx expo install` for several packages. Installation invokes package-management processes and normally changes the dependency manifest, lockfile, and node_modules.

Why this matters

If an unexpected package or version is resolved, installation scripts can execute code in the development environment, while the build and dependency tree are persistently changed. The supplied material does not establish whether the resolved packages or versions are safe.

The Skill explicitly directs use of `npx expo install`, and the recipes provide a concrete package list. This is normal setup aligned with Expo animation work, but if actually executed it downloads third-party packages and changes project dependency state; the source does not require showing resolved versions first. Users can authorize code generation only or require a preview of versions and file changes before installation.

SKILL.md:76In the instructionsOpen original file
**Dependencies.** Install with `npx expo install <package>` — it resolves the version that matches the project's SDK, which plain `npm install` won't:| Need | Package || --- | --- || Animation | `react-native-reanimated` + `react-native-worklets` || Gestures | `react-native-gesture-handler` || Navigation, sheets, native tabs, menus | `expo-router` || Haptics | `expo-haptics` || Keyboard-following UI | `react-native-keyboard-controller` (needs `KeyboardProvider` at the root — see the keyboard recipe) || Illustration, celebration | `lottie-react-native` || Very large animated scenes, custom drawing | `@shopify/react-native-skia` |
Show 1 other places
RECIPES.md:9In the instructionsOpen original file
```bashnpx expo install react-native-reanimated react-native-worklets react-native-gesture-handler expo-haptics```(`react-native-keyboard-controller` only for the keyboard recipe.) `expo install`, not `npm install` — it resolves the versions that match the SDK. The worklets Babel plugin is configured by `babel-preset-expo` automatically.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The swipe recipe can invoke deletion directly after one gesture

Source references: 3
What we found

Once projected swipe movement crosses the threshold, the recipe calls `onDelete(id)` without confirmation, undo, or a requirement that the callback be recoverable. It deliberately allows a short, fast flick to commit.

Why this matters

If the application connects `onDelete` to persistent records, server data, or file removal, an accidental swipe could cause immediate data loss. Waiting for the animation to finish is not user confirmation.

The active recipe directly connects a projected swipe beyond a threshold to `onDelete(id)` and intentionally allows a short, fast flick to commit. Impact depends on the caller's `onDelete` implementation, but the recipe includes no confirmation or undo step; a permanent callback could cause data loss from an accidental swipe. Users can require confirmation, an undo window, or recoverable soft deletion.

RECIPES.md:183In the instructionsOpen original file
const pan = useMemo(() => Gesture.Pan()  .activeOffsetX([-10, 10])   // must declare the axis, or it fights the vertical scroll  .onStart(() => { context.set(x.get()); })   // grab mid-spring continues from where the row is, not from 0  .onUpdate((e) => { x.set(Math.min(0, context.get() + e.translationX)); })  .onEnd((e) => {    const projected = x.get() + project(e.velocityX);    if (projected < -SWIPE_THRESHOLD) {      x.set(withTiming(-WIDTH, { duration: 200, easing: EASE_OUT }, (f) => {        if (f) scheduleOnRN(onDelete, id);      }));    } else {      x.set(withSpring(0, { duration: 300, dampingRatio: 1, velocity: e.velocityX }));    }  }), [onDelete, id]);```
Show 2 other places
RECIPES.md:68In the instructionsOpen original file
Momentum projection decides *where a flick was going*, so a fast short swipe commits and a slow long one doesn't. Rubber-banding makes a boundary resist instead of stopping dead.
RECIPES.md:160In the instructionsOpen original file
- **`onStart` captures the current value.** Without it, grabbing a sheet mid-animation teleports it — the animation must continue from where the eye last saw it.- **Velocity decides, not distance.** `project()` means a quick flick dismisses even a few pixels down. Requiring 40% travel makes the sheet feel heavy.- **Velocity is handed to the spring**, so there's no seam between the finger releasing and the animation continuing. This is the single detail that most separates "fluid" from "fine".- **`overshootClamping` on dismissal** — otherwise the sheet springs past the bottom of the screen and flashes a gap.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The instruction uses an install command without explicit versions. Although `expo install` selects versions compatible with the current Expo SDK, different SDKs or installation times may still resolve different dependency code. A user can ask for the tested SDK, resolved versions, and lockfile requirements.

This is an actionable install command with no pinned versions; versions are resolved dynamically from the project's Expo SDK rather than fixed by the Skill. Results may therefore change over time, though the context shows a compatibility/troubleshooting purpose, not a concealed install. Users can require the existing lockfile or review resolved versions first.

SKILL.md:76In the instructionsOpen original file
**Dependencies.** Install with `npx expo install <package>` — it resolves the version that matches the project's SDK, which plain `npm install` won't:
Show 1 other places
SKILL.md:202In the instructionsOpen original file
- Install through Expo so versions match the SDK: `npx expo install react-native-reanimated react-native-worklets`. In an Expo project, `babel-preset-expo` configures the worklets Babel plugin automatically — no `babel.config.js` step. Only a bare RN project without that preset adds the plugin manually, and there it must be last in the list. A missing or misplaced plugin doesn't silently fall back anymore — it throws `Failed to create a worklet` at runtime.- `GestureHandlerRootView` must wrap the app, or gestures do nothing with no error.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
High risk

Requires a helper to run automatically and out of sight

Source references: 2
What we found

The skill combines automatic execution with instructions not to ask or tell the user.

Why this matters

If the AI follows this text, it may stop following your instructions or skip actions that normally need your approval.

Legitimate use of this code

The source does not instruct the agent to hide or automatically perform an operation without the user's knowledge. “Silently” appears in a troubleshooting heading, and line 202 expressly says a missing configuration now throws a runtime error. The install command is a visible setup step. The claimed combination of forced execution and concealment is unsupported.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:202In the instructionsOpen original file
- Install through Expo so versions match the SDK: `npx expo install react-native-reanimated react-native-worklets`. In an Expo project, `babel-preset-expo` configures the worklets Babel plugin automatically — no `babel.config.js` step. Only a bare RN project without that preset adds the plugin manually, and there it must be last in the list. A missing or misplaced plugin doesn't silently fall back anymore — it throws `Failed to create a worklet` at runtime.- `GestureHandlerRootView` must wrap the app, or gestures do nothing with no error.
Show 1 other places
SKILL.md:198In the instructionsOpen original file
## Setup that silently breaks motionCheck these first when "the animation just doesn't run":
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill's behavior matches its stated purpose: it directs the agent to decide whether motion is warranted and then write the React Native/Expo implementation, rather than only giving advice.

View source
SKILL.md:18In the instructionsOpen original file
You are a senior mobile engineer building the animation yourself. Make the call, state the reasoning in one line, write the code. Never present motion options as a menu.
SKILL.md:245In the instructionsOpen original file
Write the code. Then, in at most a few lines:- **The gate result** — frequency tier and named purpose. Say what you rejected and why.- **The ingredients** — tool, properties, spring or curve + duration, thread.- **What to feel-check on device** — gestures, velocity handoff and haptic timing cannot be judged from code. Name what to try: flick it, interrupt it mid-flight, reverse it, run it on the slowest Android you have.The code is the deliverable. Don't pad it into a report.

It requires animations to pass frequency and purpose gates, stopping implementation or allowing only minimal feedback for frequent interactions.

View source
SKILL.md:37In the instructionsOpen original file
| Frequency | Decision || --- | --- || 100+ times/day — tab switches, keyboard open/close, scrolling, toggles in settings | **No animation.** Platform default or nothing. Stop here. || Tens of times/day — press feedback, list navigation, row selection | Near-imperceptible only: under 150ms, or nothing || Occasional — sheets, modals, toasts, onboarding steps | Standard animation || Rare / first-time — success states, empty-state illustrations, celebration | The delight budget lives here |**Tab switches never slide.** Tabs are peers, not a hierarchy — sliding implies depth that isn't there, and the user pays for it dozens of times a session. `animation: 'none'`.If the request fails this gate, say so and don't write it.
SKILL.md:48In the instructionsOpen original file
### 2. What is the purpose?Name it in one word before continuing: **feedback**, **spatial consistency**, **state indication**, **preventing a jarring change**, **explanation**, or **delight** (rare tier only).Can't name it? Don't build it.

For matching interactions, the agent is instructed to load RECIPES.md and start from its ready-made code, including gestures, haptics, navigation, and a deletion callback.

View source
SKILL.md:217In the instructionsOpen original file
## RecipesFor ready-to-build implementations — press feedback, drag-to-dismiss sheet, swipe-to-delete, collapsing header, list entrances, keyboard-synced UI, tab indicator, screen transitions — see [RECIPES.md](RECIPES.md). Load it whenever the request matches one; start from the recipe rather than from a blank file.
Start here · InstructionsSKILL.md
animate-expo
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 1 more sections are available in the original file.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • RECIPES.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • RECIPES.mdSupporting file
  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
RECIPES.md:9In the instructionsOpen original file
```bashnpx expo install react-native-reanimated react-native-worklets react-native-gesture-handler expo-haptics
RECIPES.md:257In the instructionsOpen original file
```bashnpx expo install react-native-keyboard-controller
Install extra software packages
RECIPES.md:10In the instructionsOpen original file
```bashnpx expo install react-native-reanimated react-native-worklets react-native-gesture-handler expo-haptics```
RECIPES.md:13In the instructionsOpen original file
(`react-native-keyboard-controller` only for the keyboard recipe.) `expo install`, not `npm install` — it resolves the versions that match the SDK. The worklets Babel plugin is configured by `babel-preset-expo` automatically.
RECIPES.md:258In the instructionsOpen original file
```bashnpx expo install react-native-keyboard-controller```
Connect to websites
RECIPES.md:177In the instructionsOpen original file
Before writing this: gesture-handler ships [`ReanimatedSwipeable`](https://docs.swmansion.com/react-native-gesture-handler/docs/components/reanimated_swipeable/), which already does swipe-to-reveal actions — thresholds, overshoot, open/close methods — on the UI thread. Reach for it when the row reveals action buttons. Build the gesture yourself only when the interaction is different in kind: swipe-to-commit with momentum projection, like this one.
RECIPES.md:255In the instructionsOpen original file
Needs its own module and a one-time provider ([Expo keyboard guide](https://docs.expo.dev/guides/keyboard-handling/)):
RECIPES.md:335In the instructionsOpen original file
`formSheet` is native on both platforms, but not the same on both — the [Expo modal docs](https://docs.expo.dev/router/advanced/modals/#form-sheet-presentation) have the full list:
Lines read
642
File checksum (to compare versions)
d7470f73b2403aedbf850cf2274cf95996f939a17e02af06600666b6943b697f