hexabot-ai/action-creator
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a comprehensive developer guide for authoring Hexabot v3 actions, focusing on creating secure and reliable integrations.
- [SAFE]: Implements a secure credential handling pattern in the provided examples (
examples/create-crm-ticket.action.example.ts) by resolving secrets through a dedicated service (context.services.credentials.findOneValue) using credential IDs, rather than passing raw secrets through workflow data or inputs. - [SAFE]: Mandates the use of Zod schemas for input, output, and settings validation, which helps prevent malformed data processing and reduces the surface area for injection attacks.
- [SAFE]: Provides a specialized 'Settings and Secrets Guide' that explicitly instructs against logging or returning raw credentials and emphasizes the use of idempotency keys for write operations.
- [SAFE]: The security review checklist included in the skill covers critical topics such as PII redaction, SSRF prevention, and bounding LLM prompt context, demonstrating a high level of security maturity.
Audit Metadata