跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Animate Expo Skill 安全审计

作者说它能做什么（原文）

Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades. Writes the implementation with Reanimated, Gesture Handler, Expo Router and expo-haptics. Use when animating anything in an Expo app, adding gestures, sheets

第三方安全检查结论

先别安装或运行

已检查文件
2
发现的风险
4
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。发现 1 项风险
低风险

使用配方可能执行第三方依赖安装并修改项目依赖状态

原文依据：2 处
发现了什么

该 Skill 不只生成源代码，还明确指示运行 `npx expo install` 安装多个包。安装会获取并执行包管理流程，并通常修改依赖清单、锁文件和 node_modules。

为什么需要注意

如果解析到的包或版本不符合预期，安装脚本可在开发环境中执行代码，项目构建和依赖树也会发生持久变化。所给材料不能证明这些包或解析版本是否安全。

Skill 明确指示通过 `npx expo install` 安装依赖，配方还给出了具体包列表。这是与 Expo 动画目的相符的正常设置操作，但若代理实际执行，会下载第三方包并改变项目依赖状态；源码没有要求先展示解析版本。用户可授权仅生成代码，或要求安装前列出将解析的版本和文件变更。

SKILL.md:76来自说明文档打开原文件
**Dependencies.** Install with `npx expo install <package>` — it resolves the version that matches the project's SDK, which plain `npm install` won't:| Need | Package || --- | --- || Animation | `react-native-reanimated` + `react-native-worklets` || Gestures | `react-native-gesture-handler` || Navigation, sheets, native tabs, menus | `expo-router` || Haptics | `expo-haptics` || Keyboard-following UI | `react-native-keyboard-controller` (needs `KeyboardProvider` at the root — see the keyboard recipe) || Illustration, celebration | `lottie-react-native` || Very large animated scenes, custom drawing | `@shopify/react-native-skia` |
查看另外 1 个位置
RECIPES.md:9来自说明文档打开原文件
```bashnpx expo install react-native-reanimated react-native-worklets react-native-gesture-handler expo-haptics```(`react-native-keyboard-controller` only for the keyboard recipe.) `expo install`, not `npm install` — it resolves the versions that match the SDK. The worklets Babel plugin is configured by `babel-preset-expo` automatically.
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 1 项风险
中风险

滑动删除配方可在一次手势后直接触发删除回调

原文依据：3 处
发现了什么

配方根据预测的滑动位置达到阈值后调用 `onDelete(id)`，没有确认、撤销或要求回调仅执行可恢复操作。短而快速的滑动也被明确设计为足以触发。

为什么需要注意

如果应用把 `onDelete` 接到持久化记录、服务器数据或文件删除，误滑可能立即造成数据丢失。动画完成后才调用回调并不能提供用户确认。

该活动配方把预测滑动位置超过阈值直接连接到 `onDelete(id)`，且明确让短而快的滑动也能提交。实际影响取决于调用方如何实现 `onDelete`，但配方本身没有确认或撤销步骤；若回调永久删除数据，误滑可能造成数据丢失。用户可要求确认、撤销窗口或仅执行可恢复的软删除。

RECIPES.md:183来自说明文档打开原文件
const pan = useMemo(() => Gesture.Pan()  .activeOffsetX([-10, 10])   // must declare the axis, or it fights the vertical scroll  .onStart(() => { context.set(x.get()); })   // grab mid-spring continues from where the row is, not from 0  .onUpdate((e) => { x.set(Math.min(0, context.get() + e.translationX)); })  .onEnd((e) => {    const projected = x.get() + project(e.velocityX);    if (projected < -SWIPE_THRESHOLD) {      x.set(withTiming(-WIDTH, { duration: 200, easing: EASE_OUT }, (f) => {        if (f) scheduleOnRN(onDelete, id);      }));    } else {      x.set(withSpring(0, { duration: 300, dampingRatio: 1, velocity: e.velocityX }));    }  }), [onDelete, id]);```
查看另外 2 个位置
RECIPES.md:68来自说明文档打开原文件
Momentum projection decides *where a flick was going*, so a fast short swipe commits and a slow long one doesn't. Rubber-banding makes a boundary resist instead of stopping dead.
RECIPES.md:160来自说明文档打开原文件
- **`onStart` captures the current value.** Without it, grabbing a sheet mid-animation teleports it — the animation must continue from where the eye last saw it.- **Velocity decides, not distance.** `project()` means a quick flick dismisses even a few pixels down. Requiring 40% travel makes the sheet feel heavy.- **Velocity is handed to the spring**, so there's no seam between the finger releasing and the animation continuing. This is the single detail that most separates "fluid" from "fine".- **`overshootClamping` on dismissal** — otherwise the sheet springs past the bottom of the screen and flashes a gap.
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。发现 1 项风险
低风险

安装命令没有固定依赖版本

原文依据：2 处
发现了什么

安装命令没有指定依赖版本。同样的命令以后可能下载不同代码，你实际安装的内容可能与这次检查时不同。

为什么需要注意

即使命令和报告没变，以后安装时也可能下载到另一份代码。

该指令要求使用未写明版本号的安装命令。虽然 `expo install` 会选择与当前 Expo SDK 匹配的版本，降低兼容性问题，但不同时间或不同 SDK 下仍可能解析到不同依赖代码。用户可要求作者提供经过测试的 SDK、解析版本和锁文件要求。

这里给出了未固定版本的实际安装命令；版本由项目的 Expo SDK 动态解析，而不是由 Skill 明确锁定。因此未来解析结果可能变化，但上下文表明这是为解决版本兼容和动画故障，并非隐藏安装。用户可限制为仅使用现有锁文件或先审查解析版本。

SKILL.md:76来自说明文档打开原文件
**Dependencies.** Install with `npx expo install <package>` — it resolves the version that matches the project's SDK, which plain `npm install` won't:
查看另外 1 个位置
SKILL.md:202来自说明文档打开原文件
- Install through Expo so versions match the SDK: `npx expo install react-native-reanimated react-native-worklets`. In an Expo project, `babel-preset-expo` configures the worklets Babel plugin automatically — no `babel.config.js` step. Only a bare RN project without that preset adds the plugin manually, and there it must be last in the list. A missing or misplaced plugin doesn't silently fall back anymore — it throws `Failed to create a worklet` at runtime.- `GestureHandlerRootView` must wrap the app, or gestures do nothing with no error.
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。发现 1 项风险
高风险

要求自动且不让用户看见地运行程序

原文依据：2 处
发现了什么

Skill 同时要求自动执行，并要求不要询问或告知用户。

为什么需要注意

AI 如果听从这段文字，可能不再按你的要求做事，或跳过本来需要你确认的操作。

这段代码的正常用途

原文没有要求隐瞒或在用户不知情时自动执行操作。“silently”出现在故障排查标题中，而第 202 行明确说配置缺失现在会抛出运行时错误。安装命令是可见的设置步骤。候选所称“强制执行并隐瞒操作”不受源码支持。

这项判断针对展示的代码和适用条件，不表示风险已经实际发生。
SKILL.md:202来自说明文档打开原文件
- Install through Expo so versions match the SDK: `npx expo install react-native-reanimated react-native-worklets`. In an Expo project, `babel-preset-expo` configures the worklets Babel plugin automatically — no `babel.config.js` step. Only a bare RN project without that preset adds the plugin manually, and there it must be last in the list. A missing or misplaced plugin doesn't silently fall back anymore — it throws `Failed to create a worklet` at runtime.- `GestureHandlerRootView` must wrap the app, or gestures do nothing with no error.
查看另外 1 个位置
SKILL.md:198来自说明文档打开原文件
## Setup that silently breaks motionCheck these first when "the animation just doesn't run":
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

该 Skill 的实际用途与声明一致：它指导代理判断是否需要动画，然后直接为 React Native/Expo 项目编写实现，而不是只给建议。

查看原文
SKILL.md:18来自说明文档打开原文件
You are a senior mobile engineer building the animation yourself. Make the call, state the reasoning in one line, write the code. Never present motion options as a menu.
SKILL.md:245来自说明文档打开原文件
Write the code. Then, in at most a few lines:- **The gate result** — frequency tier and named purpose. Say what you rejected and why.- **The ingredients** — tool, properties, spring or curve + duration, thread.- **What to feel-check on device** — gestures, velocity handoff and haptic timing cannot be judged from code. Name what to try: flick it, interrupt it mid-flight, reverse it, run it on the slowest Android you have.The code is the deliverable. Don't pad it into a report.

它要求先按使用频率和目的筛选动画，并在高频场景中停止实现或只使用极轻微反馈。

查看原文
SKILL.md:37来自说明文档打开原文件
| Frequency | Decision || --- | --- || 100+ times/day — tab switches, keyboard open/close, scrolling, toggles in settings | **No animation.** Platform default or nothing. Stop here. || Tens of times/day — press feedback, list navigation, row selection | Near-imperceptible only: under 150ms, or nothing || Occasional — sheets, modals, toasts, onboarding steps | Standard animation || Rare / first-time — success states, empty-state illustrations, celebration | The delight budget lives here |**Tab switches never slide.** Tabs are peers, not a hierarchy — sliding implies depth that isn't there, and the user pays for it dozens of times a session. `animation: 'none'`.If the request fails this gate, say so and don't write it.
SKILL.md:48来自说明文档打开原文件
### 2. What is the purpose?Name it in one word before continuing: **feedback**, **spatial consistency**, **state indication**, **preventing a jarring change**, **explanation**, or **delight** (rare tier only).Can't name it? Don't build it.

匹配常见交互时，代理会加载 RECIPES.md，并可能从其中的现成代码开始；这些配方包括手势、触觉反馈、导航和删除回调。

查看原文
SKILL.md:217来自说明文档打开原文件
## RecipesFor ready-to-build implementations — press feedback, drag-to-dismiss sheet, swipe-to-delete, collapsing header, list entrances, keyboard-synced UI, tab indicator, screen transitions — see [RECIPES.md](RECIPES.md). Load it whenever the request matches one; start from the recipe rather than from a blank file.
从这里开始 · 工作说明SKILL.md
animate-expo
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。 另有 1 个章节，可在原文件中查看。

文件引用关系图

1 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录2 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • RECIPES.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • RECIPES.md配套文件
  • SKILL.md工作说明

代码和说明中提到的操作

运行命令
RECIPES.md:9来自说明文档打开原文件
```bashnpx expo install react-native-reanimated react-native-worklets react-native-gesture-handler expo-haptics
RECIPES.md:257来自说明文档打开原文件
```bashnpx expo install react-native-keyboard-controller
安装其他软件包
RECIPES.md:10来自说明文档打开原文件
```bashnpx expo install react-native-reanimated react-native-worklets react-native-gesture-handler expo-haptics```
RECIPES.md:13来自说明文档打开原文件
(`react-native-keyboard-controller` only for the keyboard recipe.) `expo install`, not `npm install` — it resolves the versions that match the SDK. The worklets Babel plugin is configured by `babel-preset-expo` automatically.
RECIPES.md:258来自说明文档打开原文件
```bashnpx expo install react-native-keyboard-controller```
连接外部网站
RECIPES.md:177来自说明文档打开原文件
Before writing this: gesture-handler ships [`ReanimatedSwipeable`](https://docs.swmansion.com/react-native-gesture-handler/docs/components/reanimated_swipeable/), which already does swipe-to-reveal actions — thresholds, overshoot, open/close methods — on the UI thread. Reach for it when the row reveals action buttons. Build the gesture yourself only when the interaction is different in kind: swipe-to-commit with momentum projection, like this one.
RECIPES.md:255来自说明文档打开原文件
Needs its own module and a one-time provider ([Expo keyboard guide](https://docs.expo.dev/guides/keyboard-handling/)):
RECIPES.md:335来自说明文档打开原文件
`formSheet` is native on both platforms, but not the same on both — the [Expo modal docs](https://docs.expo.dev/router/advanced/modals/#form-sheet-presentation) have the full list:
读取了多少行
642
文件校验值（用于核对版本）
d7470f73b2403aedbf850cf2274cf95996f939a17e02af06600666b6943b697f