hono
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides documentation for using
npx hono requestandnpx workers-fetchto test application endpoints. These tools are standard within the Hono and Cloudflare Workers ecosystems for local development and testing. - [INDIRECT_PROMPT_INJECTION]: As a development assistant, the skill ingests user requirements to generate code and execute testing commands, creating an indirect injection surface.
- Ingestion points: User prompts asking to build, modify, or test Hono applications (runtime).
- Boundary markers: Absent; no explicit delimiting of user content from system instructions.
- Capability inventory: Execution of shell commands via
npxfor endpoint testing (SKILL.md). - Sanitization: Absent; no specific instructions provided to validate or escape user-supplied paths or data before command interpolation.
- [SAFE]: The skill includes a clear warning to users against passing sensitive credentials directly through CLI arguments, recommending the use of environment variables instead. External dependencies are standard packages from the well-known Hono ecosystem.
Audit Metadata