cors({ origin: (origin) => origin, credentials: true }) lets every website call your API with your users' cookies and read the answers, and c.html() with a plain template string sends ${c.req.query('q')} to the browser unescaped, because only the html tag escapes. This skill finds those and the other Hono mistakes below before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your Hono code (TypeScript and JavaScript on Cloudflare Workers, Bun, Deno or Node, including jsr:@hono/hono imports) and your wrangler.toml or wrangler.json. It skips comments and test files, follows request data (params, query, headers, cookies, body and validated input) through local variables, treats the html tag, JSX, D1 .bind() and tagged SQL templates as safe, knows that c.env bindings and env(c) are not literal secrets, and counts secureHeaders(), csrf() and bodyLimit() registered anywhere in the project. It never runs your app. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• H01: cors() with credentials and an origin function that returns any request origin, or an Access-Control-Allow-Origin header copied from the request
• H02: JWT, Basic and Bearer auth secrets or signed-cookie secrets written in code, as a fallback value, or in Wrangler vars (public keys and settings such as token lifetimes are left alone)
• H03: request data in raw(), in c.html() with a plain template string or a same-file function that builds one, or in dangerouslySetInnerHTML
• H04: SQL for D1, pg, Prisma or Drizzle built from request data with a template literal or + (placeholder lists and values picked from fixed choices are fine)

REVIEW (check before release)

• H11: CORS credentials with origin '*', origin checks with startsWith, includes, endsWith without a dot or unanchored regexes, and csrf() that allows cross-site requests
• H12: c.redirect() to a URL from the request without an origin or allow-list check (a startsWith('/') check alone still lets /\evil.com through)
• H13: apps that serve HTML without secureHeaders()
• H14: upload routes without bodyLimit()
• H15: onError returning error messages or stack traces
• H16: cookie-auth POST routes without csrf() or SameSite session cookies
• H17: auth middleware registered after the routes it should protect
• H18: session cookies without httpOnly or secure
• H19: c.html() fed by a view function called with request data that the scanner cannot see into

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example Workers project (Hono routes, D1, R2 and wrangler.toml), and the real report the scanner produces on the risky one

Limits

It reads each file on its own and follows request data only through variables in that file: values passed into helpers in other files and chained route definitions are not followed, and secureHeaders(), csrf() and bodyLimit() count for the whole project without matching their paths. It does not check your Hono version against security advisories, Cloudflare dashboard settings, or secrets set with wrangler secret put. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 17 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (9 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.