mobile-deployment-eas

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes an example that instructs creating a secret by passing its value on the CLI (eas secret:create --value "your-token"), which requires the LLM or user to embed the secret verbatim in a command/output, creating an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes app update configuration that points at a runtime fetch URL which delivers executable JS updates to the app (remote code execution) via https://u.expo.dev/${process.env.EAS_PROJECT_ID}, so the skill relies on that external runtime content to control application behavior.