hono
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents interfaces for processing external data from HTTP requests, such as JSON bodies, query parameters, and route parameters. It provides clear guidance on sanitization by recommending the
@hono/zod-validatormiddleware to validate inputs against schemas, reducing the risk of processing malicious data. - [COMMAND_EXECUTION]: Includes routine project initialization commands using package managers (e.g.,
npm create hono@latest,npm install,bun init). These are standard procedures for web development projects and do not involve suspicious shell execution or privilege escalation. - [CREDENTIALS_UNSAFE]: Code examples demonstrate the use of environment variables (
process.env.API_TOKEN,process.env.JWT_SECRET) for authentication. The documentation explicitly advises against hardcoding secrets and points to platform-appropriate solutions like Cloudflare Wrangler secrets for production environments.
Audit Metadata