·
Last changedVersion:
This version passed the hardening gate. Hardening applied 11 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 13. Review findings remaining: 0.
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Open |
1 finding
Use EAS Build to create development clients for testing native code changes on physical devices. Use this for creating custom Expo Go clients for testing branches of your app.
Development clients are the recommended setup for any real or production app. Expo Go is a playground for learning and quick experiments with the native libraries it bundles; most apps outgrow it and move to a development client. See Expo Go vs. development builds for the full reasoning.
You must use a dev client, because Expo Go cannot run these, when using:
Ensure eas.json has a development profile:
Key settings:
developmentClient: true - Bundles expo-dev-client for development buildsautoIncrement: true - Automatically increments build numbersappVersionSource: "remote" - Uses EAS as the source of truth for version numbersBefore running this command, tell the user that it uses paid EAS build minutes and Apple credentials and uploads the build to App Store Connect, then wait for the user's explicit approval. Development client builds on TestFlight are for internal testers only, because they expose the dev menu and dev server connections.
Build iOS dev client and submit to TestFlight in one command:
This will:
After receiving the TestFlight email:
Build a development client on your machine:
Local builds output:
.ipa file for physical devices. Installing on a simulator needs a build profile with the iOS simulator option turned on, which produces a .tar.gz archive that contains the .app bundle.apk or .aab fileInstall only artifacts produced by the user's own local build. Replace the file names below with the exact path the build printed, list the archive contents before extracting, extract into a dedicated folder, and confirm with the user that the file is the one just built.
Install iOS build on simulator:
Install iOS build on device (requires signing):
Install Android build:
Cloud builds upload the project to EAS and use paid build minutes. Before running any of these commands, tell the user and wait for explicit approval, and prefer the local commands above when feasible. Make sure secret files and environment files are excluded from the upload, and keep sensitive values in EAS secrets rather than in the repository.
Once installed, the dev client provides:
Connect only to the user's own local or trusted development server, and scan QR codes or open URLs only from sources the user trusts. Run Metro on a trusted network. Make sure expo is installed as a project dependency so npx runs the local package.
Connect to local development:
When you launch the dev client yourself to screenshot or drive it, skip the onboarding sheet, the dev menu at launch, and the Tools button. On SDK 58+, Expo CLI does this for launches it starts from a non-interactive shell; for a URL you open yourself, use <scheme>://?__expo_url=<encoded dev server URL>&__expo_disable_onboarding=1&__expo_disable_fab=1&__expo_disable_auto_launch=1. On SDK 57 and earlier, launch the iOS app with the -EXDevMenu* launch arguments, and on Android open <scheme>://expo-development-client/?url=<encoded dev server URL>&disableOnboarding=1&disableFab=1&disableAutoLaunch=1. See ../expo-overview/references/launch-without-dev-menu.md for the exact commands. That file belongs to a separate skill; review it with the user before following its commands. Use the onboarding, fab, and auto launch options only for agent-driven automation against the user's own local server.
Build fails with signing errors:
This command is interactive. Run it together with the user, review the existing credentials first, and get explicit user approval before creating, replacing, or removing any certificate or key.
Clear build cache:
This starts a new paid cloud build, so get the user's explicit approval first.
Check EAS CLI version:
The eas update command publishes over the air app updates to testers and users. It is a release step, so use it only when the user asks to publish an update. Upgrade the EAS CLI through the normal package manager after confirming with the user.
Get started with chainctlchainctl skill install public/expo/expo-dev-client:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/expo/plugins/expo/skills/expo-dev-client:latest
MIT
HARDENING.md
LICENSE
SKILL.md
agents/openai.yaml