native-data-fetching
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements patterns for fetching data from external APIs and processing route parameters, which constitutes an indirect prompt injection surface if those external sources are compromised.
- Ingestion points: API responses fetched via the
fetchAPI in bothSKILL.mdandreferences/expo-router-loaders.md, as well as routeparamsandrequestheaders in the route loader documentation. - Boundary markers: The documentation includes explicit security guidance in the 'Best Practices' section, advising users to validate and sanitize input before use.
- Capability inventory: The skill provides templates for network requests (
fetch) and sensitive credential storage (expo-secure-store). - Sanitization: Sanitization is recommended for database queries and API calls within the route loader documentation, although the provided snippets focus on basic functionality.
Audit Metadata