hex-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill refers to the
hextoolkitandairflow-provider-hexPython packages, which are standard utilities for interacting with the Hex analytics platform. These are documented neutrally as requirements for the provided code examples. - [INDIRECT_PROMPT_INJECTION]: The skill handles project parameters (
params) that may originate from external inputs. This creates a potential surface for indirect injection; however, the skill mitigates this by providing explicit instructions to exclude API tokens, SQL, and workspace data from the output receipts. - [SAFE]: No malicious behaviors, obfuscation, persistence mechanisms, or unauthorized privilege escalations were detected. The skill uses standard environment variable patterns for managing credentials.
Audit Metadata