App audit

Evidence-backed, read-only audits for existing Expo consumer apps.

Use $expo-app-audit when an existing Expo or React Native consumer app needs a quick, standard, or deep audit. The master router runs $expo-project-orientation first so the audit starts from a verified stack card instead of greenfield assumptions. Standard is the default depth.

Workflow

1. Orient the existing app and capture its stack card.
2. Select audit depth and only the relevant domain skills.
3. Inspect repository evidence across architecture, runtime, config, data, security, native surface, UI, accessibility, tests, and maintainability as applicable.
4. Add $expo-design-review when UI is in scope.
5. Close with $expo-verify using safe local checks only.

Output contract

The report always contains Scope, Stack card, Executive summary, Findings, Verification evidence, Unknowns and skipped checks, Recommended remediation order, and Residual risk. Every finding has an ID, severity, domain, repository-relative evidence, problem, impact, recommendation, owning skill or pattern, and fix authorization.

Authorization and composition

Audit, review, assess, and inspect are read-only. Recommendations do not authorize edits; remediation requires a separate explicit request. The audit may compose domain skills such as $expo-auth, $expo-data-fetching, $expo-permissions, or $expo-native-ui, but it does not load every catalog skill. It never runs EAS, store, OTA, cloud, remote simulator, or signed-binary actions by inference.

Verification limitations

Static checks and repository evidence cannot prove device behavior, visual quality, native integration, or cloud configuration. The report names every skipped check and carries those gaps into residual risk.

Copy-paste prompt

Use $expo-development-foundation to audit this existing Expo app at standard depth. Start with project orientation, remain read-only, cite file evidence for every finding, include design and accessibility when UI is present, run only safe local verification, and report skipped checks plus residual risk.