react-native-expo

Pin the npx package to an exact version (e.g., npx @scope/package@1.2.3). Unversioned npx commands can silently install a different or malicious package version.

Likely FP if the npx command targets a well-known package in documentation context, though unpinned versions are a real supply chain concern.

Pin the npx package to an exact version (e.g., npx @scope/package@1.2.3). Unversioned npx commands can silently install a different or malicious package version.

Likely FP if the npx command targets a well-known package in documentation context, though unpinned versions are a real supply chain concern.

Pin the npx package to an exact version (e.g., npx @scope/package@1.2.3). Unversioned npx commands can silently install a different or malicious package version.

Likely FP if the npx command targets a well-known package in documentation context, though unpinned versions are a real supply chain concern.

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

Pin the npx package to an exact version (e.g., npx @scope/package@1.2.3). Unversioned npx commands can silently install a different or malicious package version.

Likely FP if the npx command targets a well-known package in documentation context, though unpinned versions are a real supply chain concern.