# Audit Expo API Integrations

Expo apps often hide broken API flows, unsafe token handling, and stale screen data. This skill guides Claude, Codex, or Claude Code through a structured API audit.

## Install

```bash
npx skillstore add cjharmath/expo-api-audit
```

## Metadata

- Status: approved
- Slug: cjharmath-expo-api-audit
- Skillstore revision: r1
- Version status: missing
- Tree hash: d8ce1e010a764789d74abc1db6c64ee97c2df94e82ca0c9524d2a3c7e37a7bba
- Author: CJHarmath
- GitHub username: CJHarmath
- License: MIT
- Repository: https://github.com/CJHarmath/claude-agents-skills/tree/main/skills/expo-api-audit
- Ref: 02f077c174c5335e2f5d02ca15e77b70d9543e58
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem, env\_access
- Quality score: 69
- Public page: https://skillstore.pages.dev/skills/cjharmath-expo-api-audit
- Manifest: https://skillstore.pages.dev/api/skills/cjharmath-expo-api-audit/manifest

## Capabilities

- Maps Orval config, generated hooks, Axios clients, token managers, stores, Expo config, and screens.
- Reviews auth token storage, refresh flow, interceptors, 401 handling, and logout behavior.
- Finds direct fetch or Axios calls that bypass generated API hooks.
- Flags hardcoded URLs, process.env usage, mock screen data, and frontend-only persistence.
- Checks React Query offline modes, cache persistence, reconnect behavior, and error boundaries.
- Produces prioritized audit findings with affected files, impact, and recommended fixes.

## Use Cases

- Pre-release API Review: Audit an Expo app before release to catch broken backend sync, hardcoded data, and missing error handling.
- Auth Flow Hardening: Check token storage, refresh behavior, interceptors, and logout paths for Expo security issues.
- Generated Client Cleanup: Find screens and services that bypass Orval hooks or duplicate server state in local stores.

## Prompt Templates

### Basic API Review

```
Audit my Expo app API integration. Focus on generated hooks, direct API calls, and hardcoded screen data.
```

### Auth Token Audit

```
Review auth token handling in my Expo app. Check storage, refresh flow, interceptors, and logout behavior.
```

### Offline Sync Review

```
Audit offline behavior for React Query and Expo networking. Check cached reads, failed mutations, reconnect behavior, and error states.
```

### Full Integration Report

```
Run a full Expo API integration audit. Return prioritized findings with affected files, severity, impact, and recommended fixes.
```

## Limitations

- Requires repository access and shell commands to inspect local project files.
- Does not run emulator, device, or end-to-end mobile tests by itself.
- Orval and package manager commands may require explicit user confirmation.
- Findings should be checked against backend contracts and product requirements.

## Best Practices

- Run the audit from the repository root so file discovery stays scoped.
- Confirm before executing package manager commands or project code generators.
- Review high-severity auth findings before lower-priority cleanup items.

## Anti Patterns

- Do not run global installs without explicit user approval.
- Do not treat every direct API call as wrong without checking its purpose.
- Do not paste secret values into the audit report.

## Security Audit

- Audited at: 2026-07-05T07:49:58.565\+00:00
- Summary: Most static findings are false positives caused by Markdown fences, inline code, and literal search patterns. The skill shows no prompt injection, credential exfiltration, or hidden network destination evidence. Two contextual risks remain: optional package installation instructions and an Orval dry-run command that may execute project configuration.

## Stats

- Views: 289
- Downloads: 9
- Favorites: 0
- Popularity score: 0