Skip to content
Back to skills

Expo Development

ASecurity

Expo and React Native apps: Continuous Native Generation, EAS Build and Update, Expo Router. Use when creating or configuring an Expo app, its EAS builds, native modules, routes or OTA updates.

  • 80 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added October 3, 2026
ai-agentsgoswiftkotlinreactgitci/cd

Works with

  • cli

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned October 5, 2026

npx -y skills add monkilabs/opencastle --skill expo-development --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Expo Development?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Expo Development
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/monkilabs-expo-development/badge)](https://www.skillsdirectory.com/skills/monkilabs-expo-development)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: expo-development
description: "Expo and React Native apps: Continuous Native Generation, EAS Build and Update, Expo Router. Use when creating or configuring an Expo app, its EAS builds, native modules, routes or OTA updates."
---

# Expo Development

## Continuous Native Generation

- Never eject, never edit `ios/` or `android/` — `npx expo prebuild` regenerates both from `app.json` / `app.config.ts`, so hand edits vanish. Gitignore both directories. `npx expo prebuild --clean` when native state is suspect.
- Native config changes go through config plugins (`app.plugin.js`, registered in `expo.plugins`) applied at prebuild time. `npx create-expo-module` scaffolds a Swift + Kotlin module.
- Install with `npx expo install`, not `npm install`, so versions resolve against the SDK. `npx expo install --fix` repairs an SDK version mismatch.

## EAS Build / Update

- `eas.json` profiles: development = `developmentClient: true` + `distribution: internal`; preview = `distribution: internal` + `channel`; production = `channel` + `autoIncrement: true`.
- Set `runtimeVersion: { policy: "fingerprint" }` in app.json. `eas update --channel production` ships JS only — a runtimeVersion mismatch forces a new binary build, and native changes can never go OTA.
- Rollback: `eas update:republish --group <previous-group-id>`. Diagnose failures via `eas build:list` then `eas build:view <id>`.
- Secrets belong in EAS environment variables with secret visibility (`eas env:create --visibility secret`; `eas secret:create` is deprecated), never `app.json`; device-side storage via `expo-secure-store`.
- iOS signing failures: `eas credentials`. CI/CD lives in `.eas/workflows/`.

## Expo Router

Files under `app/` are routes; a `_layout.tsx` per directory supplies `<Stack>` / `<Tabs>` / `<Drawer>`. Parenthesized directories are groups and do not appear in the URL — `app/(auth)/login.tsx` serves `/login`. Read dynamic segments with `useLocalSearchParams()`. Deep links require `scheme` in app.json; `myapp://user/123` then resolves to `app/user/[id].tsx`.

Docs: https://docs.expo.dev/

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.