hono

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes examples that place an Authorization bearer token directly in a command-line header (e.g., -H "Authorization: Bearer token"), which instructs embedding secrets verbatim in generated commands and thus risks secret exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s workflow is based on running hono search / hono docs commands to retrieve Hono documentation at runtime, which is public web content authored by third parties and then ingested as readable text into the agent context.