expo-data-fetching Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• SKILL.md promises coverage of SWR in the description, but the provided skill content does not include any SWR-specific examples or guidance.
• The skill is reference-heavy and lacks an explicit step-by-step workflow or decision framework for choosing between fetch, React Query, SWR, and Expo Router loaders.
• Security best practices are only implicit; the skill could more clearly warn against logging tokens, leaking auth headers, or fetching untrusted URLs.
• Some sections appear truncated in the submitted excerpt (e.g., the authFetch example cuts off), which may reduce clarity if the full SKILL.md is not complete.
• Quality score needs review
• Permission surface needs review: secrets or environment access, shell or command execution
• Dependency/runtime risk: command execution surface, credential or environment access
• Permission surface: secrets or environment access, shell or command execution

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.