mobile-ai-features
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill provides explicit warnings against bundling API keys within mobile app binaries, noting that they can be easily extracted via decompilation. It demonstrates the correct pattern of using a backend proxy (e.g., Cloudflare Workers) where secrets are stored in environment variables (
env.OPENAI_API_KEY). - [EXTERNAL_DOWNLOADS]: All external references target official documentation and well-known services, including OpenAI, Anthropic, Google AI, and Expo. These are trusted industry-standard sources for the functionality described.
- [COMMAND_EXECUTION]: Instructions use standard development commands (
npx expo install) to add verified libraries (expo-av,expo-camera) to the project environment. - [INDIRECT_PROMPT_INJECTION]: The skill documents the ingestion of user-supplied prompts and image data for AI processing. This is a standard functional surface for AI integration skills and is implemented here with appropriate authentication patterns (Bearer tokens) and architectural separation.
Audit Metadata