Agent skill · Audited from source
github
skill · callstackincubator/agent-skillsMIT licenceAudited 22 Oct 2026 · source 0e6278daa242
Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit 0e6278daa242 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 9 findings, 0 critical or high. What it does: Assesses whether and how an existing mobile product should migrate to React Native. Use when auditing one or more product repositories for migration readiness, including products whose iOS, Android, and other clients…
Cite
Cite this page
ModelsAtlas. “github (callstackincubator/agent-skills)”. Retrieved 22 Oct 2026. https://modelsatlas.com/skills/callstackincubator/github
Trust audit
Audit 0.4.1 · source read 22 Oct 2026
CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | WARN | 9 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (9)
MEDIUMInventory / provenanceinv.symlink · plugins/building-react-native-apps/skills/create-react-native-library
plugins/building-react-native-apps/skills/create-react-native-library
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · plugins/building-react-native-apps/skills/react-native-best-practices
plugins/building-react-native-apps/skills/react-native-best-practices
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · plugins/building-react-native-apps/skills/react-native-tv-best-practices
plugins/building-react-native-apps/skills/react-native-tv-best-practices
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · plugins/building-react-native-apps/skills/react-navigation
plugins/building-react-native-apps/skills/react-navigation
- Why
- link not followed
- Fix
- —
LOWInventory / provenanceinv.symlink · CLAUDE.md
CLAUDE.md
- Why
- link not followed
- Fix
- —
INFOInventory / provenanceinv.oversize · plugins/building-react-native-apps/assets/callstack-plugin-icon.png
plugins/building-react-native-apps/assets/callstack-plugin-icon.png
- Why
- 1381840 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · plugins/migrating-to-react-native/assets/callstack-plugin-icon.png
plugins/migrating-to-react-native/assets/callstack-plugin-icon.png
- Why
- 1322976 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · plugins/testing-react-native-apps/assets/callstack-plugin-icon.png
plugins/testing-react-native-apps/assets/callstack-plugin-icon.png
- Why
- 1162334 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · skills/react-native-best-practices/references/images/view-hierarchy-flattening.png
skills/react-native-best-practices/references/images/view-hierarchy-flattening.png
- Why
- 2587021 bytes not read
- Fix
- —
Audit 0.4.1 · source sha 0e6278daa242 · 22 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishercallstackincubator GitHub organizationOwner of the repository this skill is read from
- Source foldercallstackincubator/agent-skillsThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict0e6278daa242A new audit runs when the source changes
- Repository statusNot archivedLast push 13 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Assesses whether and how an existing mobile product should migrate to React Native. Use when auditing one or more product repositories for migration readiness, including products whose iOS, Android, and other clients…
--- name: assess-react-native-migration description: Assesses whether and how an existing mobile product should migrate to React Native. Use when auditing one or more product repositories for migration readiness, including products whose iOS, Android, and other clients live in separate directories or repositories; choosing brownfield, greenfield, or a checkpoint-based path; defining a representative trial; or preparing a baseline and ROI decision before implementation. When product scope or material evidence is unavailable, grills the stakeholder with exactly one question per turn instead of sending a questionnaire. license: MIT --- # Assess React Native Migration Produce a read-only migration decision. Diagnose the product and delivery system; do not execute the migration. ## Establish Product Scope Run the assessment from a workspace that exposes as many production client codebases as possible. The current checkout is not evidence that it contains the whole product. Before assessing readiness: 1. Inspect the current repository and every workspace root available to the agent. 2. Infer supported client platforms from product documentation, CI, release configuration, workspace manifests, submodules, and references to sibling repositories. 3. Locate each production client codebase, including separate native iOS and Android repositories, app variants, and any web client relevant to staffing or proposed code sharing. 4. Record a platform inventory with the client, repository or path, evidence of product membership, and access status. When iOS and Android are both supported, inspect both native codebases before recommending a path. If a codebase remains unavailable, mark its evidence `unknown`, state that the assessment covers only the accessible platforms, and lower confidence accordingly. Do not infer that a platform is unsupported merely because its project is absent from the current repository. **Scope gate:** every supported production client is listed, and each codebase is accessible, explicitly unavailable, or confirmed not to exist. ## First Response Gate When the scope gate has not passed, the first response must be exactly: ```markdown **Question:** Where can I access the production codebase for each client platform this product supports, including iOS and Android if both exist? **Why it matters:** A migration path based on only one platform can miss native dependencies, product behavior, and delivery constraints that change the decision. ``` After the scope gate passes, grill rather than survey when repository evidence is unavailable. If the measurable migration driver is unknown, the first response must be exactly: ```markdown **Question:** What measurable delivery or business problem should a React Native migration solve? **Why it matters:** This determines whether migration is relevant and which outcomes the assessment must test. ``` If the driver is already known, ask only the next highest-impact unknown using the same two-line shape. End the turn immediately after the question and reason. Do not add a preamble, questionnaire, recommendation, or implementation guidance. ## Rules - Treat every production app as a source of truth, including undocumented behavior. - Inspect available code, CI, tests, release configuration, product documents, and runtime evidence before asking questions. - Compare iOS and Android explicitly where their implementation, behavior, dependencies, delivery, or roadmap differ. - Base product-wide claims only on evidence from every supported platform, or qualify their platform coverage. - Label material claims `observed`, `measured`, `reported`, `assumed`, or `unknown`. - Recommend from evidence, not an aggregate readiness score. - Default to gathering evidence, not to brownfield, greenfield, or migration itself. - Own the decision phase. Do not apply implementation skills or select Expo versus bare React Native before Path A is accepted. - Count only React Native's marginal value over the current native system. - Measure agents by accepted, verified work, not tokens, generated code, or pull requests. - Make no universal claims about duration, cost, code sharing, agent productivity, or ROI. ## Select the Evidence Mode Use repository-backed assessment when source code or delivery artifacts are available: 1. Complete the platform inventory and establish which repositories the assessment can inspect. 2. For each accessible mobile codebase, locate app variants, CI, tests, release configuration, architecture records, and product documentation. 3. Search each native codebase for SDKs, permissions, app extensions, storage, authentication, push, deep links, analytics, experiments, and platform-specific behavior. 4. Cite repository names plus file paths and line numbers so evidence remains attributable when codebases are separate. 5. Ask stakeholders only for missing codebase locations or for product, organizational, and operational facts the repositories cannot establish. Use interview assessment when the repository is unavailable or material evidence remains missing: 1. Start with the measurable delivery or business problem unless the user already supplied it. 2. Ask exactly one decision-changing question per turn. 3. Explain in one sentence which path, risk, or assumption the answer affects. 4. Challenge vague or contradictory answers with a narrower follow-up instead of accepting them as evidence. 5. Record the answer, update the evidence state, and choose the next highest-impact unknown. 6. Stop grilling when another answer cannot change the recommendation, confidence, or checkpoint. Before the evidence gate passes, every response must contain only: ```markdown **Question:** [one question] **Why it matters:** [one sentence] ``` Do not include a questionnaire, path recommendation, checkpoint, or implementation guidance during these turns. If the user pauses the interview, return the current evidence state and the single highest-impac
Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 0e6278d
npm install -D eslint-plugin-no-barrel-files npm install @rnx-kit/metro-serializer-esbuild npm install react-native-reanimated react-native-worklets npm install jotai npm install zustand
git clone https://github.com/callstackincubator/agent-skills git -C agent-skills checkout 0e6278daa242
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 0e6278daa242 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
| GitHub Copilot | Mentioned in its text, not tested | Skills for GitHub Copilot · About GitHub Copilot |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
| Gemini CLI | Mentioned in its text, not tested | Skills for Gemini CLI · About Gemini CLI |
| Windsurf | Mentioned in its text, not tested | Skills for Windsurf · About Windsurf |
Audit history
Every audit, every source change
- !CAUTION B 89 / 100
first audit · source
0e6278daa242
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/callstackincubator/github/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
obra/superpowers
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions…
obra/superpowers
Use when you have a spec or requirements for a multi-step task, before touching code
obra/superpowers
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
Add this badge to your README
[](https://modelsatlas.com/skills/callstackincubator/github/)
<a href="https://modelsatlas.com/skills/callstackincubator/github/"><img src="https://modelsatlas.com/skills/callstackincubator/github/badge.svg" alt="ModelsAtlas: CAUTION B"></a>
Questions about github
What does the github skill do?
Is github safe to install?
What can github access on my machine?
Which assistants does github work with?
How current is this page?
Sources
- github.com/callstackincubator/agent-skills — the audited source at commit 0e6278daa242 and every finding aboveObserved · 22 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the github skill do?
- Is github safe to install?
- What can github access on my machine?