native-data-fetching
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential management practices. It explicitly warns against putting secrets in environment variables prefixed with
EXPO_PUBLIC_(which are inlined in the client bundle) and recommends usingexpo-secure-storeinstead ofAsyncStoragefor sensitive data like authentication tokens. - [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for handling external API data. It includes a specific best practice section advising developers to 'Validate and sanitize user input (params, query strings) before using in database queries or API calls,' which effectively mitigates common injection risks when processing untrusted data.
- [EXTERNAL_DOWNLOADS]: The skill references standard, well-known libraries in the React Native ecosystem, such as React Query and Expo Router. All external API examples use generic placeholders (e.g.,
api.example.com) or well-known services (e.g.,api.stripe.com) in a diagnostic/tutorial context.
Audit Metadata