Expo EAS Hosting Deployments

The evidence clearly discloses that EAS Hosting is paid, recommends keeping secrets server-side, forbids exposing API keys to clients, and calls for input validation and error handling. However, deployment, production release, environment-secret creation, and custom-domain changes require no explicit user confirmation and provide no data-flow disclosure, permission scoping, rollback plan, or recovery path. The wildcard CORS example, incomplete authentication example, and proxy pattern that interpolates user input into a third-party URL warrant deductions.

The document covers export, deployment, API routes, environment variables, runtime limits, and local curl checks, so the main path is coherent. However, it contains no committed tests or reproducible execution evidence; abnormal inputs, deployment failures, authentication failures, and rollback feedback are thin, and command/platform behavior is not verified within the supplied files. Static calibration therefore caps this below 10.

The audience and scenarios are reasonably clear, with explicit separation between websites/API routes, EAS Hosting, and native builds/store releases, plus several cases where API routes are not appropriate. Trigger conditions, input/output contracts, and non-fit boundaries remain coarse; Chinese-language support is not addressed, nor is reachability of EAS, Cloudflare, or related services from mainland-China networks.

The skill is readable and layered across scenarios, examples, runtime constraints, and deployment. It declares version 1.0.0 and MIT licensing, while repository-level documentation provides general installation and update guidance. It lacks skill-specific changelog information, a named maintenance owner, a precise update path, a real FAQ, and systematic troubleshooting; the custom-domain section is especially underspecified.

The examples can directly support common API-route authoring and EAS Hosting deployment tasks, including TypeScript, curl, CLI, and workflow snippets. Production use still requires substantial review and additions for authentication, validation, secret rotation, database connectivity, restricted CORS, and upstream error handling; some examples forward upstream responses without checking failure status. Static review cannot establish end-to-end completion, so the score is capped at 7 or below.

The document includes limited traceability through Expo pricing, workflow-syntax references, and official documentation links in the repository README. The selected skill has no tests, CI coverage, compatibility matrix, or third-party execution evidence, so the assessment relies mainly on author-provided instructions and static inspection.