expo-api-routes
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides examples of API routes that ingest untrusted user data via request bodies (e.g., 'app/api/ai+api.ts') and query parameters (e.g., 'app/api/weather+api.ts'). While code examples omit explicit validation for brevity, the skill includes a specific 'Rules' section that mandates all user input be validated and sanitized before processing. Ingestion points: request.json(), url.searchParams. Boundary markers: Absent in examples. Capability inventory: fetch, db.execute. Sanitization: Required by skill rules.
- [COMMAND_EXECUTION]: Includes standard, expected developer commands for the Expo ecosystem, such as 'npx expo serve' for local testing and 'eas deploy' for production deployment.
- [EXTERNAL_DOWNLOADS]: References well-known and trusted developer tools and libraries including 'eas-cli' and the '@libsql/client' package for database connectivity.
Audit Metadata