native-data-fetching
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Network Operations: The skill implements patterns for making HTTP requests to external services using the fetch API.
- Evidence: Found in
SKILL.md(e.g.,fetch('https://api.example.com/users')) andreferences/expo-router-loaders.md. - Context: These operations are central to the skill's purpose. The instructions recommend using non-prefixed environment variables for server-side secrets and
SecureStorefor client-side token storage to mitigate data exposure risks. - Indirect Prompt Injection Surface: The skill provides a framework for ingesting data from external APIs into the agent's context, which could potentially contain untrusted instructions.
- Ingestion points: Data is fetched via
fetchcalls and Expo Router loaders inSKILL.mdandreferences/expo-router-loaders.md. - Boundary markers: The skill demonstrates typical JSON parsing but does not explicitly show specialized prompt delimiters for the fetched content.
- Capability inventory: The skill utilizes network capabilities (
fetch) and storage access (SecureStore). - Sanitization: The documentation in
references/expo-router-loaders.mdexplicitly advises developers to "Validate and sanitize user input... before using in database queries or API calls," which is a proactive security measure.
Audit Metadata