expo-api-routes
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill provides templates for creating API proxies that process user-supplied data for external services. While these endpoints handle untrusted input, the skill proactively includes security rules for validation. (1) Ingestion points: User data is accessed through request.json() and search parameters in routes such as app/api/ai+api.ts. (2) Boundary markers: The examples demonstrate standard HTTP request handling; developers are encouraged by the skill's guidelines to add specific validation layers. (3) Capability inventory: Functionality is limited to standard network requests (fetch) to integrated services. (4) Sanitization: The skill includes a high-level rule to 'ALWAYS validate and sanitize user input,' promoting secure development practices.
- External Resource Integration: The skill interacts with established services like OpenAI and utilizes official Expo command-line tools for environment management, following secure-by-default practices for handling API keys.
Audit Metadata