native-data-fetching
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill contains educational content and code templates for common networking tasks in the Expo ecosystem. The provided examples follow industry standards for security and maintainability.
- [SAFE]: The skill implements secret management best practices by recommending
expo-secure-storefor sensitive data and warning against the inclusion of secrets in client-side environment variables. - [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for ingesting external data, creating a potential surface for indirect injection.
- Ingestion points: Data is fetched from external APIs in SKILL.md and processed via URL parameters (
params.id) and query strings (request.url) in references/expo-router-loaders.md. - Boundary markers: Not applicable to instructional code snippets.
- Capability inventory: The skill provides examples of network requests (
fetch) and secure storage access (SecureStore). - Sanitization: The skill explicitly mandates best practices in the reference file: 'Validate and sanitize user input (params, query strings) before using in database queries or API calls.'
Audit Metadata