hex-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a shell script that uses
curlandtarto gather project, connection, and run metadata from the Hex API. These operations are limited to collecting diagnostics and packaging them into a local archive. - [CREDENTIALS_SAFE]: Authentication is managed via the
HEX_API_KEYenvironment variable rather than hardcoded secrets. The diagnostic script includes a logic check to verify the key's presence without outputting the secret value to logs or files. - [EXTERNAL_DOWNLOADS]: The skill communicates exclusively with
app.hex.tech, which is the official domain for the Hex platform. These network operations are necessary for the skill's primary function of retrieving workspace metadata. - [INDIRECT_PROMPT_INJECTION]: While the skill interacts with external API data, it treats the results as static diagnostic evidence. Furthermore, the instructions include a mandatory redaction policy to prevent sensitive or malicious content from being processed by the agent.
Audit Metadata