hono
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for initializing projects using standard package managers, such as
npm create hono@latestandbun add hono. These target well-known, official registries and are standard development practices. - [COMMAND_EXECUTION]: Documentation includes standard shell commands for development and deployment, such as
npm run devandnpm run deploy. These are intended for local development within the user's project environment. - [INDIRECT_PROMPT_INJECTION]: The skill describes building APIs that ingest untrusted user input (JSON bodies, query parameters). It mitigates this risk by explicitly recommending and demonstrating the use of
zValidatorwith Zod for strict schema validation and sanitization of all incoming data. - [CREDENTIALS_SAFE]: Code examples correctly demonstrate using
process.envor Cloudflare Worker bindings (c.env) for managing sensitive information like JWT secrets and API tokens, avoiding hardcoded credentials.
Audit Metadata