native-data-fetching
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill promotes secure credential management by recommending the use of
expo-secure-storefor authentication tokens instead of insecure alternatives likeAsyncStorage. It also includes clear warnings against including sensitive keys in environment variables prefixed withEXPO_PUBLIC_, as these are embedded into the client bundle. - [DATA_EXFILTRATION]: No malicious data exfiltration patterns were detected. The provided code examples for authenticated requests include safety checks, such as verifying the destination origin before attaching authorization headers (e.g., checking if the target origin matches the expected API domain).
- [COMMAND_EXECUTION]: The skill focuses on application-level networking APIs (fetch, React Query) and does not contain any shell command execution, subprocess calls, or other patterns related to operating system command injection.
- [INDIRECT_PROMPT_INJECTION]: While the skill involves processing external data from APIs, it provides best practices for validating and sanitizing this input. The instructions guide the agent to handle tool outputs safely, reducing the risk of indirect instruction obedience from untrusted data sources.
Audit Metadata