Skill

ios26-navigation

skill:wix/react-native-navigation#ios26-navigation

Reference for iOS 26 navigation bar, tab bar, toolbar, and Liquid Glass building blocks (UITab, scroll-edge effects, search placement, shared-background platter, UIButton glass configurations, UIGlassEffect / UIGlassContainerEffect, UINavigationItem.style navigator/browser/editor, UICornerConfiguration / concentric corners, UISheetPresentationController, SF Symbols 7) plus the internal view hierarchy of UIBarButtonItem and UIToolbar, and how react-native-navigation maps to all of it. Use when adding or fixing iOS 26 behavior in RNN's top bar, bottom tabs, bar buttons, toolbar, modals, or any glass-styled custom chrome; when investigating iOS 26-only regressions; or when deciding how to expose a new iOS 26 capability through RNN options.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:39 UTC at 3cd6bfe

findings

high

highest severity

threat classes

2,830

files scanned

1,706/1,713

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.cursor/skills/ios26-navigation:.cursor/skills/ios26-navigation/SKILL.md:18:HIJACK
suspicious: finding skill:.cursor/skills/ios26-navigation:.cursor/skills/ios26-navigation/SKILL.md:22:HIJACK
suspicious: finding skill:.cursor/skills/ios26-navigation:playground/e2e/AndroidUtils.js:9:PRIVESC
suspicious: finding skill:.cursor/skills/ios26-navigation:playground/e2e/Utils.js:16:CRED
suspicious: finding skill:.cursor/skills/ios26-navigation:playground/e2e/Utils.js:23:CRED

Security findings 5

Credential access

highContextual risklow confidence

Undeclared residue of a navigation-reference skill: playground/e2e/Utils.js loadImage reads caller-supplied file paths via readFileSync (used to load snapshot PNGs for SSIM bitmap diffing), a dynamic file-read capability the declared documentation purpose does not need and does not declare, but nothing conceals it (adjudicated: unexplained).

playground/e2e/Utils.js:16

const image = PNG.sync.read(readFileSync(path));

vector:code

Counter-argument considered

The dynamic readFileSync in loadImage is a real undeclared file-read (residue R1) reachable from bitmapDiff, and no carve-out or cited mitigation covers a documentation-only skill shipping it; visible-but-unexplained residue is not evidence of safety.

Credential access

highContextual risklow confidence

Undeclared residue of a navigation-reference skill: playground/e2e/Utils.js bitmapDiff reads two caller-supplied image paths via loadImage for SSIM snapshot comparison, file reads the declared documentation purpose does not need or declare, but nothing conceals them (adjudicated: unexplained).

playground/e2e/Utils.js:23

const expectedImage = loadImage(expectedImagePath);

vector:code

Counter-argument considered

bitmapDiff's two caller-supplied path loads are undeclared for the documentation-only capability (residue R2/R3) and chain into the SSIM comparison sink; no carve-out or mitigation in the shown evidence neutralizes them, so the finding stands.

Agent hijacking

mediumContextual risklow confidence

The skill directs the agent to pair with the rnn-codebase and rnn-e2e-runner skills, whose instruction content lies outside the reviewed artifact (not consumed and not served), so the agent loads steering instructions from those paths at runtime that this review cannot see.

.cursor/skills/ios26-navigation/SKILL.md:18

Pair this with `rnn-codebase` (repo navigation) and `rnn-e2e-runner` (validation).

vector:instruction

Counter-argument considered

The skill body does instruct the agent to pair with rnn-codebase and rnn-e2e-runner, and the follow-up shows both targets lie outside consumed content (NOT CONSUMED / NOT SERVED), so the pairing sends the agent to steering instructions this review cannot see; the reference is open but declaring a reference does not declare or neutralize what is loaded at runtime, and absence of the served copy is never evidence of safety, so no harm/undeclared/chain gate fails.

Agent hijacking

mediumContextual riskmedium confidence

The skill instructs the agent to follow a workspace rule at .cursor/rules/rnn-build-release.mdc that is not shipped in the reviewed repository, so at runtime the agent applies build-verification instructions from that path whose content cannot be reviewed.

.cursor/skills/ios26-navigation/SKILL.md:22

see workspace rule `rnn-build-release.mdc`

vector:instruction

Counter-argument considered

The skill instructs the agent to apply the rnn-build-release.mdc workspace rule, which is NOT IN REPOSITORY, so at runtime the agent applies whatever sits at that path; the missing file never makes the load instruction harmless or chain-free, the reference is covered by no declared claim (D2/D3 declare only the toolchain line), and no carve-out applies, so no gate fails.

Privilege escalation

mediumContextual risklow confidence

Undeclared residue of a navigation-reference skill: playground/e2e/AndroidUtils.js grants and revokes android.permission.READ_PHONE_STATE on the playground test app and runs arbitrary commands via execSync adb shell, device permission manipulation the declared documentation purpose does not need or declare, but nothing conceals it (adjudicated: unexplained).

playground/e2e/AndroidUtils.js:9

pm grant com.reactnativenavigation.playground android.permission.READ_PHONE_STATE

vector:code

Counter-argument considered

Granting/revoking READ_PHONE_STATE against the fixed playground package via an open execSync adb-shell sink is outside every listed carve-out and outside the declared iOS-26-documentation capability, and the shown units contain no mitigation; visible-but-unexplained residue is not evidence of safety, so it stands.

Open questions 6

What the analysis could not settle from the code alone.

Four PY-CLAIM-CONTRADICTION leads classify documentation text as PERSIST, quoting a '- **overCurrentContext** - Display the modal and do not remove previous content when the show anima...' claim at SKILL.md lines 120-122 and 405 contradicted by 'file_write UIBarButtonItemGroup' / '.mm'; however, the shown content of SRC:133e6304bb4a321d (lines 115-136) contains only UIBarButtonItemGroup factory signatures and SRC:257243ae2e2c915c (lines 401-411) contains only a regression-investigation workflow,⟦… 168 more chars …⟧

[file request .cursor/skills/engine-e2e/SKILL.md] The ios26-navigation skill pairs with `rnn-e2e-runner` (validation) and the repository match suggests this file; does this skill execute or run anything beyond e2e validation, or steer the agent beyond the declared task?

Code execution

[file request .claude/skills/rnn-codebase/SKILL.md] The ios26-navigation skill pairs with `rnn-codebase` (repo navigation) whose .cursor copy is NOT CONSUMED; do this skill's instructions stay within repo navigation or steer the agent beyond the declared task?

Agent hijacking

[file request .cursor/rules/rnn-build-release.mdc] The skill directs the agent to follow this workspace rule for all build verification; does the rule contain agent instructions that go beyond build/release configuration (e.g. persistence, network sends, credential access, or behavior overrides)?

Agent hijacking

[file request .cursor/skills/rnn-codebase/SKILL.md] The skill tells the agent to pair with rnn-codebase for repo navigation; do that skill's instructions stay within repo navigation or steer the agent beyond the declared task?

Agent hijacking

[file request .cursor/skills/rnn-e2e-runner/SKILL.md] The skill tells the agent to pair with rnn-e2e-runner for validation; does that skill execute or run anything beyond e2e validation, or steer the agent beyond the declared task?

Code execution