{"data":{"skill":{"slug":"expo-expo-api-routes","name":"expo-api-routes","icon":"📦","repo":"https://github.com/expo/skills/tree/main/plugins/expo-app-design/skills/expo-api-routes/","status":"approved","author":"expo","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"8b8e8aac-98e5-41d6-a303-56af639efc28","skill_id":"9b8d7f09-7513-4a63-a139-a057254d6b06","version":2,"content_hash":"e58f77fe535ed9f6e61abc1acf32a1ba","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Educational documentation for Expo Router API routes. All static findings are false positives. Detected patterns (code blocks, API examples, environment variables) represent safe documentation demonstrating best practices for server-side API development.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":358,"line_start":33}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":353,"line_start":139}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":336,"line_start":336}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":353,"line_start":143}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Documentation Pattern: Code Block Syntax","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":358,"line_start":35}],"confidence":0.95,"description":"Static scanner flagged backticks in markdown code blocks as shell command execution. All 49 instances are documentation examples (file paths, code snippets) in SKILL.md, not actual code execution.","confidence_reasoning":"Backticks in markdown documentation represent inline code formatting and code blocks, not Ruby/shell execution. No actual command execution occurs in this documentation file."},{"title":"Documentation Pattern: API Endpoint Examples","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":139,"line_start":139},{"file":"SKILL.md","line_end":204,"line_start":204},{"file":"SKILL.md","line_end":210,"line_start":209},{"file":"SKILL.md","line_end":265,"line_start":265},{"file":"SKILL.md","line_end":353,"line_start":352}],"confidence":0.95,"description":"Static scanner flagged fetch calls as network requests. These are legitimate documentation examples showing proper server-side API usage patterns (OpenAI, weather API proxies, local testing).","confidence_reasoning":"Fetch calls in documentation examples demonstrate proper API integration patterns. All are documented as examples with no actual network requests being made."},{"title":"Documentation Pattern: Import Path References","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":336,"line_start":336}],"confidence":0.95,"description":"Static scanner flagged relative paths as path traversal. These are standard TypeScript import statements in code examples for authentication utilities.","confidence_reasoning":"Relative import path ../../utils/auth is standard TypeScript syntax for importing utility modules, not malicious path traversal."},{"title":"Documentation Pattern: Environment Variable Access","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":143,"line_start":143},{"file":"SKILL.md","line_end":291,"line_start":290},{"file":"SKILL.md","line_end":353,"line_start":353}],"confidence":0.95,"description":"Static scanner flagged process.env references as credential access. These are legitimate documentation examples teaching secure secret handling in server-side code.","confidence_reasoning":"process.env examples demonstrate secure credential handling - exactly what this skill teaches. Secrets are accessed server-side, never exposed to clients."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":369,"audit_model":"claude","audited_at":"2026-01-23T07:20:32.952+00:00","created_at":"2026-01-23T07:25:22.508597+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":4,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}