hono

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for initializing projects using standard package managers, such as npm create hono@latest and bun add hono. These target well-known, official registries and are standard development practices.
  • [COMMAND_EXECUTION]: Documentation includes standard shell commands for development and deployment, such as npm run dev and npm run deploy. These are intended for local development within the user's project environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes building APIs that ingest untrusted user input (JSON bodies, query parameters). It mitigates this risk by explicitly recommending and demonstrating the use of zValidator with Zod for strict schema validation and sanitization of all incoming data.
  • [CREDENTIALS_SAFE]: Code examples correctly demonstrate using process.env or Cloudflare Worker bindings (c.env) for managing sensitive information like JWT secrets and API tokens, avoiding hardcoded credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 03:13 PM
Security Audit — agent-trust-hub — hono