expo-system-ui

Dangerous workflowscaution

Two pull_request_target workflows exist, which warrants review because that trigger can carry elevated workflow risk. However, no untrusted checkouts or script-injection findings were detected in the analyzed workflows.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention expo-system-ui, creating some uncertainty about package-to-repository mapping. The package file tree nevertheless shows module-specific native and source files, partly compensating for that concern.

Token permissionscaution

Twenty-four analyzed workflows lack top-level permissions and six declare top-level write access; although job-level settings may constrain some jobs, this is a meaningful workflow hygiene gap.