跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Eas Update Insights Skill 安全审计

作者说它能做什么（原文）

EAS service (paid). Check the health of published EAS Update: crash rates, install/launch counts, unique users, payload size, and the split between embedded and OTA users per channel. Use when the user asks how an update is performing, whether a rollout is healthy, how many users are on the embedded build vs OTA, or wants to gate CI on update health.

第三方安全检查结论

发现安全风险

已检查文件
4
发现的风险
4
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。发现 1 项风险
中风险

安装和反馈步骤会执行未固定版本的 npm 包

原文依据：4 处
发现了什么

先决条件建议全局安装 `eas-cli`，升级说明使用 `@latest`，反馈命令还通过 `npx --yes` 自动下载并运行最新版工具。版本未固定意味着未来发布的包代码会以用户权限执行；所给材料没有包含这些包的实现供审计。

为什么需要注意

如果 npm 包、发布账户或最新版依赖被入侵，执行时可能读取或修改用户可访问的文件、环境变量和凭据。全局安装还会持续改变开发环境。

该 Skill 的先决条件会全局安装未固定版本的 `eas-cli`，故障处理又建议安装 `@latest`；反馈流程还用 `npx --yes` 自动获取并执行最新版工具。用户实际采用这些步骤时，npm 包代码会以其权限运行，而所给源码没有这些包的实现，因此无法从材料中审计其未来内容。正常使用 EAS CLI 与提交反馈可以解释这些操作，但用户可要求作者固定并校验版本，或禁止代理自行安装/升级及运行反馈工具。

SKILL.md:34来自说明文档打开原文件
- `eas-cli` installed (`npm install -g eas-cli`).- Logged in: `eas login`.- For `channel:insights`: run from an Expo project directory (the command resolves the project ID from `app.json`). `update:insights` only needs a login.
查看另外 3 个位置
SKILL.md:118来自说明文档打开原文件
- `Update group "<id>" has no ios update (available platforms: android)` — `--platform ios` was used but the group wasn't published for iOS.- `EAS Update insights is not supported by this version of eas-cli. Please upgrade ...` — the server deprecated a field the CLI relies on. Run `npm install -g eas-cli@latest`.
SKILL.md:233来自说明文档打开原文件
## Submitting FeedbackIf you encounter errors, misleading or outdated information in this skill, report it so Expo can improve:```bashnpx --yes submit-expo-feedback@latest --category skills --subject "eas-update-insights" "<actionable feedback>"```Only submit when you have something specific and actionable to report. Include as much relevant context as possible.If an AI agent repeatedly failed or the user had to take over an Expo task, load the expo-skill-feedback skill and follow its eval-candidate flow instead of reusing the command above.
SKILL.md:234来自说明文档打开原文件
If you encounter errors, misleading or outdated information in this skill, report it so Expo can improve:```bashnpx --yes submit-expo-feedback@latest --category skills --subject "eas-update-insights" "<actionable feedback>"```Only submit when you have something specific and actionable to report. Include as much relevant context as possible.
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 1 项风险
中风险

反馈流程可能把用户提供的项目上下文发送给 Expo

原文依据：3 处
发现了什么

说明让用户通过提交工具向 Expo 报告问题，并要求加入尽可能多的相关上下文。反馈文本会作为命令参数交给外部 npm 工具；材料没有说明传输字段、保留期限或脱敏措施。

为什么需要注意

如果用户粘贴日志、更新消息、项目标识、内部故障详情、路径或凭据，相关内容可能离开本机并暴露给外部服务；命令参数也可能被本机 shell 历史或进程列表记录。

反馈流程明确要求向 Expo 报告，并把反馈内容作为外部 npm 工具的参数；它还鼓励加入尽可能多的相关上下文。若代理把日志、项目标识、账户信息或其他敏感上下文填入占位符，这些内容可能被发送给 Expo。材料没有列出具体字段、脱敏或保留规则。提交被限定为有明确可操作内容时，并非自动执行；用户可要求提交前展示完整内容、移除敏感信息并取得确认。

SKILL.md:232来自说明文档打开原文件
## Submitting FeedbackIf you encounter errors, misleading or outdated information in this skill, report it so Expo can improve:```bashnpx --yes submit-expo-feedback@latest --category skills --subject "eas-update-insights" "<actionable feedback>"```Only submit when you have something specific and actionable to report. Include as much relevant context as possible.If an AI agent repeatedly failed or the user had to take over an Expo task, load the expo-skill-feedback skill and follow its eval-candidate flow instead of reusing the command above.
查看另外 2 个位置
SKILL.md:234来自说明文档打开原文件
If you encounter errors, misleading or outdated information in this skill, report it so Expo can improve:```bashnpx --yes submit-expo-feedback@latest --category skills --subject "eas-update-insights" "<actionable feedback>"```Only submit when you have something specific and actionable to report. Include as much relevant context as possible.
SKILL.md:237来自说明文档打开原文件
```Only submit when you have something specific and actionable to report. Include as much relevant context as possible.If an AI agent repeatedly failed or the user had to take over an Expo task, load the expo-skill-feedback skill and follow its eval-candidate flow instead of reusing the command above.
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。发现 2 项风险
中风险

不完整且滞后的遥测被建议用于发布门禁

原文依据：4 处
发现了什么

Skill 明确宣称可在 CI 中依据更新健康度设置门禁，并给出 `crashRatePercent > 1` 的筛选示例。然而它同时说明 OTA 用户数可能少计或跨平台重复、刚发布时可能为零、安装和失败报告会延迟，而且部分崩溃不会出现。示例没有最小样本量、等待期或统计置信度要求。

为什么需要注意

自动门禁可能把不健康的发布误判为健康，或因小样本和延迟数据阻断正常发布，从而扩大故障、影响用户，或造成不必要的发布中断。

Skill 将这些聚合指标用于 CI 发布门禁，并展示了以 `crashRatePercent > 1` 筛选最近一天数据的回归检测示例，但没有规定最低样本量、稳定等待期或置信度。同时源码承认新发布可能暂时为零、安装与失败上报滞后，且部分崩溃不会被记录；跨平台用户数也可能重复。若把简单阈值直接当作自动发布决策依据，可能误放行或误阻止发布。用户可要求门禁加入样本量、数据新鲜度、等待期及人工复核。

agents/openai.yaml:4来自说明文档打开原文件
  short_description: "Paid EAS service. Check EAS Update health, adoption, crash rates, launch counts, payload size, and OTA vs embedded usage"  default_prompt: "Use $eas-update-insights to inspect published EAS Update with eas-cli, compare rollout health, gather update or channel metrics, parse JSON output, and gate releases on aggregate update performance."
查看另外 3 个位置
SKILL.md:203来自说明文档打开原文件
### Detect a rollout regression in the last 24 hours```basheas update:insights "$GROUP_ID" --days 1 --json --non-interactive \  | jq '.platforms[] | select(.totals.crashRatePercent > 1)'```
SKILL.md:227来自说明文档打开原文件
- **Unique users across platforms** may double-count users who run the same publish on both iOS and Android. The same caveat applies to `otaTotalUniqueUsers` in channel insights, which is a sum over `mostPopularUpdates`.- **Fresh publishes** may show zeros for a short period while the metrics pipeline catches up.- **Installs are downloads, not launches**: the `installs` / "Launches" field counts users who downloaded the manifest and launch asset. A confirmed run only registers on the user's *next* update check (typically up to 24h later, depending on the app's update policy). So metrics lag the real-world state slightly.- **Crashes are self-reported**: `failedInstalls` / "Crashes" counts updates that errored during install/launch and were reported on the next update check. Crashes that don't trigger an update request (e.g. process kill before recovery) won't appear.
SKILL.md:229来自说明文档打开原文件
- **Fresh publishes** may show zeros for a short period while the metrics pipeline catches up.- **Installs are downloads, not launches**: the `installs` / "Launches" field counts users who downloaded the manifest and launch asset. A confirmed run only registers on the user's *next* update check (typically up to 24h later, depending on the app's update policy). So metrics lag the real-world state slightly.- **Crashes are self-reported**: `failedInstalls` / "Crashes" counts updates that errored during install/launch and were reported on the next update check. Crashes that don't trigger an update request (e.g. process kill before recovery) won't appear.
低风险

使用 EAS Update Insights 可能消耗付费配额

原文依据：1 处
发现了什么

Skill 说明 EAS Update 是带免费额度限制的付费服务，更新交付及这些命令背后的数据会计入套餐用量。

为什么需要注意

频繁的监控或 CI 查询可能消耗组织配额，并可能增加费用或更快触及套餐限制。该成本风险在 Skill 中已有明确提示。

源码明确标注 EAS Update 是带免费额度限制的付费服务，并称更新交付和这些命令背后的数据会计入套餐用量。因此，在已连接的 EAS 项目中查询或依赖这些数据可能影响用户的付费配额。材料没有量化单次查询的具体费用；用户可在使用前核对当前套餐、免费额度和预期用量。

SKILL.md:11来自说明文档打开原文件
> **EAS service - costs apply.** Insights cover updates published through EAS Update, a paid Expo Application Services product with free-tier limits. Update delivery and the data behind these commands count against your plan's EAS Update usage. Review https://expo.dev/pricing.

Skill 逻辑拆解

8 个说明模块

该 Skill 本身主要是操作说明；实际数据访问委托给已安装的 `eas` CLI。它会列出更新、读取单个更新组的运行指标，以及按频道和运行时版本读取 embedded/OTA 用户指标。

查看原文
SKILL.md:42来自说明文档打开原文件
|---|---|| `eas update:list` | Discover recent update groups, their `group` IDs, and branch names || `eas update:insights <groupId>` | Per-platform launches, failed launches, crash rate, unique users, payload size, daily breakdown || `eas update:view <groupId> --insights` | Update group details + the same metrics appended || `eas channel:insights --channel <name> --runtime-version <version>` | Embedded/OTA user counts, most popular updates, cumulative metrics for a channel + runtime |All of these support `--json --non-interactive` for programmatic parsing.

访问依赖当前 `eas` 登录身份；频道查询还会从当前 Expo 项目的 `app.json` 解析项目 ID。因此查询到哪个账户和项目，取决于用户当前的登录和工作目录。

查看原文
SKILL.md:34来自说明文档打开原文件
- `eas-cli` installed (`npm install -g eas-cli`).- Logged in: `eas login`.- For `channel:insights`: run from an Expo project directory (the command resolves the project ID from `app.json`). `update:insights` only needs a login.

返回数据是聚合指标，而不是单个用户或设备的崩溃记录。输出可包含更新消息、组 ID、用户数、安装/失败次数及负载大小，并适合脚本解析。

查看原文
SKILL.md:30来自说明文档打开原文件
Don't use when the user needs per-user crash detail or device-level reporting; this skill only exposes aggregate EAS metrics.
SKILL.md:102来自说明文档打开原文件
### JSON output shapeTop level: `groupId`, `timespan` (`start`, `end`, `daysBack`), and `platforms[]` with one entry per platform the group was published to. Each platform entry has `updateId`, `totals` (`uniqueUsers`, `installs`, `failedInstalls`, `crashRatePercent`), `payload` (`launchAssetCount`, `averageUpdatePayloadBytes`), and a `daily[]` time series of `{ date, installs, failedInstalls }`.
从这里开始 · 工作说明SKILL.md
eas-update-insights
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。 另有 3 个章节，可在原文件中查看。

文件引用关系图

2 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录4 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/channel-insights-schema.md已纳入全文
  • references/update-insights-schema.md已纳入全文
  • agents/openai.yaml已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • agents/openai.yaml配套文件
  • references/channel-insights-schema.md配套文件
  • references/update-insights-schema.md配套文件

代码和说明中提到的操作

运行命令
SKILL.md:6来自说明文档打开原文件
license: MITallowed-tools: "Bash(eas *)"---
SKILL.md:53来自说明文档打开原文件
```bash# Latest group id across all branches
SKILL.md:88来自说明文档打开原文件
```basheas update:insights 03d5dfcf-736c-475a-8730-af039c3f4d06
连接外部网站
SKILL.md:11来自说明文档打开原文件
> **EAS service - costs apply.** Insights cover updates published through EAS Update, a paid Expo Application Services product with free-tier limits. Update delivery and the data behind these commands count against your plan's EAS Update usage. Review https://expo.dev/pricing.
安装其他软件包
SKILL.md:34来自说明文档打开原文件
- `eas-cli` installed (`npm install -g eas-cli`).- Logged in: `eas login`.
SKILL.md:118来自说明文档打开原文件
- `Update group "<id>" has no ios update (available platforms: android)` — `--platform ios` was used but the group wasn't published for iOS.- `EAS Update insights is not supported by this version of eas-cli. Please upgrade ...` — the server deprecated a field the CLI relies on. Run `npm install -g eas-cli@latest`.
SKILL.md:235来自说明文档打开原文件
```bashnpx --yes submit-expo-feedback@latest --category skills --subject "eas-update-insights" "<actionable feedback>"```
读取了多少行
362
文件校验值（用于核对版本）
39ea73d355bfb9eceda413b801bbeec81bde6477a514dfd9f6d9d1f74f4d4f06