expo-api-routes

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains a CLI example that embeds a literal API secret value ("sk-xxx") as a command-line argument (eas env:create --value sk-xxx), which is an insecure pattern because it requires or demonstrates including a secret verbatim in output/commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow shown in SKILL.md includes an API route that takes a runtime prompt from the HTTP request body (await request.json()), which is outsider-authored user input, and then feeds it into the LLM call as messages: [{ role: "user", content: prompt }] (indirect prompt injection risk).