native-data-fetching
Facilitates implementation and debugging of network requests and API calls, covering error handling and caching strategies.
Install this skill
Security score
The native-data-fetching skill was audited on Mar 3, 2026 and we found 26 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 36 | const response = await fetch(`https://api.example.com/users/${userId}`); |
Template literal with variable interpolation in command context
| 39 | throw new Error(`HTTP error! status: ${response.status}`); |
Template literal with variable interpolation in command context
| 54 | Authorization: `Bearer ${token}`, |
Template literal with variable interpolation in command context
| 221 | Authorization: token ? `Bearer ${token}` : "", |
Template literal with variable interpolation in command context
| 307 | const response = await fetch(`${API_URL}/users`); |
Template literal with variable interpolation in command context
| 334 | const response = await fetch(`${BASE_URL}${path}`); |
Template literal with variable interpolation in command context
| 335 | if (!response.ok) throw new Error(`HTTP ${response.status}`); |
Template literal with variable interpolation in command context
| 340 | const response = await fetch(`${BASE_URL}${path}`, { |
Template literal with variable interpolation in command context
| 345 | if (!response.ok) throw new Error(`HTTP ${response.status}`); |
Template literal with variable interpolation in command context
| 454 | if (!response.ok) throw new Error(`HTTP ${response.status}`); |
Fetch to external URL
| 50 | const response = await fetch("https://api.example.com/users", { |
Access to .env file
| 299 | // .env |
Access to .env file
| 304 | const API_URL = process.env.EXPO_PUBLIC_API_URL; |
Access to .env file
| 315 | // .env.development |
Access to .env file
| 318 | // .env.production |
Access to .env file
| 326 | const BASE_URL = process.env.EXPO_PUBLIC_API_URL; |
Access to .env file
| 356 | - Restart the dev server after changing `.env` files |
Access to .env file
| 432 | | |-- Client-side URLs -> EXPO_PUBLIC_ prefix in .env |
Access to .env file
| 434 | | \-- Multiple environments -> .env.development, .env.production |
Access to .env file
| 488 | -> Use EXPO*PUBLIC* env vars with .env.development and .env.production files |
Access to .env file
| 491 | -> Client-safe keys: EXPO*PUBLIC* in .env. Secret keys: non-prefixed env vars in API routes only |
External URL reference
| 36 | const response = await fetch(`https://api.example.com/users/${userId}`); |
External URL reference
| 50 | const response = await fetch("https://api.example.com/users", { |
External URL reference
| 300 | EXPO_PUBLIC_API_URL=https://api.example.com |
External URL reference
| 316 | EXPO_PUBLIC_API_URL=http://localhost:3000 |
External URL reference
| 319 | EXPO_PUBLIC_API_URL=https://api.production.com |