Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fatihkan/badi --skill expo-eas-updategit clone --depth 1 https://github.com/fatihkan/badiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fatihkan/badi/expo-eas-update)<a href="https://agentmods.dev/skills/fatihkan/badi/expo-eas-update"><img src="https://agentmods.dev/badge/skills/fatihkan/badi/expo-eas-update/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fatihkan/badi/expo-eas-update"><img src="https://agentmods.dev/badge/skills/fatihkan/badi/expo-eas-update.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 31 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Excessive Agency · line 183 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.01493 |
| Opus 5 | $0.00032 | $0.00746 |
| Sonnet 5 | $0.00013 | $0.00299 |
| Haiku 4.5 | $0.00006 | $0.00149 |
Grade A, and why
expo-eas-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.
expo-eas-update
OTA (over-the-air) update publishing discipline with EAS Update. Channel/branch model, runtime-version strategy, rollback, and embedded vs OTA payload decisions. Build profiles live in expo-eas-build.
What It Does
- Publishing JS/asset payloads with
eas update - Channel ↔ branch mapping management
- Runtime-version discipline (
appVersion/sdkVersion/fingerprint/ custom) - Branch management (preview, staging, production, feature/*)
- Rollback and cohort/rollout-percent strategy
- Embedded update vs OTA payload selection
Setup
npx expo install expo-updates
eas update:configure
app.json:
{
"expo": {
"runtimeVersion": { "policy": "appVersion" },
"updates": {
"url": "https://u.expo.dev/<project-id>",
"fallbackToCacheTimeout": 0,
"checkAutomatically": "ON_LOAD",
"enabled": true
}
}
}
Channel ↔ Branch Model
| Build channel | Branch | Purpose |
|---|---|---|
| development | development | Dev client OTA |
| preview | preview | QA test |
| production | production | Production |
A single branch can be bound to different channels (eas channel:edit production --branch hotfix-1).
Runtime Version Policies
| Policy | How it's derived | Usage |
|---|---|---|
appVersion |
expo.version |
Native change = new build + new runtime |
sdkVersion |
Expo SDK | SDK upgrade = new runtime (no longer recommended) |
nativeVersion |
version+buildNumber |
Every build a different runtime — OTA usually won't apply |
fingerprint |
Native dependency fingerprint | Recommended: auto-detects whether native changed |
fingerprint (the default recommendation in modern Expo):
"runtimeVersion": { "policy": "fingerprint" }
Publishing an Update
# Publish to a branch
eas update --branch production --message "fix: profile crash"
# Same name as the current Git branch
eas update --auto
# A single platform only
eas update --branch production --platform ios --message "iOS-only fix"
# Channel list
eas channel:list
eas branch:list
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 211 lines · 65 tokens per session scan A 2beb134d7311
expo-eas-update is a skill published in the GitHub repository fatihkan/badi (7 stars, last pushed 2d ago), licensed MIT. It adds 65 tokens to every session and 1,493 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other skills, from other repositories
pr-triage
4-phase PR backlog management with audit, deep code review, validated comments, and optional worktree setup. Use when triaging pull requests, catching up on pending code reviews, or managing a backlog of open PRs. Args: 'all' to review all, PR numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit…
eval-agents
Audit Claude Code agents defined in .claude/agents/ for description specificity, model tier appropriateness, tools scoping, and system prompt quality. Detects dispatch ambiguity between agents, flags over-permissive tool grants, and checks for human-in-the-loop patterns that break programmatic orchestration. Use when…
issue-triage
3-phase issue backlog management with audit, deep analysis, and validated triage actions. Use when triaging GitHub issues, sorting bug reports, cleaning up stale tickets, or detecting duplicate issues. Args: 'all' to analyze all, issue numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit only.
review-pr
Perform a comprehensive code review of a pull request.
landing-page-generator
Generate complete, deploy-ready landing pages from any repository. Use when creating a homepage for an open-source project, building a project website, converting a README into a marketing page, or standardizing landing pages across multiple repos.
talk-stage5-script
Produces a complete 5-act pitch with speaker notes, a slide-by-slide specification, and a ready-to-paste Kimi prompt for AI slide generation. Requires validated angle and title from Stage 4. Use when you have a confirmed talk angle and need the full script, slide spec, and AI-generated presentation prompt.