The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents standard Expo commands for build and deployment (npx expo serve, npx expo export) which are expected developer workflows and do not pose a risk.
[CREDENTIALS_UNSAFE]: The skill correctly instructs developers to avoid using EXPO_PUBLIC_ for secret keys and explicitly warns against storing tokens in AsyncStorage, recommending expo-secure-store instead. It shows examples of reading from process.env for server-side secrets, which is a standard and safe practice.
[DATA_EXFILTRATION]: The networking examples target api.example.com, api.stripe.com, and api.production.com. These are legitimate examples of API communication within a developer skill. No patterns of sensitive file reading combined with network transmission were found.
[PROMPT_INJECTION]: The instructions are focused on providing implementation guidance for networking. There are no attempts to override agent behavior or bypass safety filters.
[REMOTE_CODE_EXECUTION]: The skill demonstrates standard fetching of data and use of legitimate packages like @tanstack/react-query and @react-native-community/netinfo. It does not contain patterns for downloading and executing untrusted scripts (e.g., curl|bash).

native-data-fetching