eas-simulator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and installing runtime artifacts (which execute code) from https://expo.dev/artifacts/eas/.tar.gz and uses a runtime manifest URL https://.on.expo.app to load app JS into the remote simulator, so these external URLs are fetched during runtime and directly control executed code.