expo-updates

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill config includes the runtime OTA update URL "https://u.expo.dev/[project-id]", which is fetched at runtime to download and run JavaScript/asset updates (remote code execution) and is required for the update flow, so it directly controls executed code.