{"data":{"skill":{"slug":"yusukebe-hono-inertia","name":"hono-inertia","icon":"📦","repo":"https://github.com/yusukebe/skills/tree/7b3a6c2b2930d90304f1b44954fdc1a1a70d26be/skills/hono-inertia","status":"approved","author":"yusukebe","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"1c120a44-d4bb-42ca-9b2f-3135d6efd7e6","skill_id":"3d013786-9cb9-4404-9b5d-f3bc440d7cd4","version":1,"content_hash":"v3:5e1f762ecf28b75c366ed9b67053b444b2eb9ffd:d5705815b3de396d0b99b31fda80c41803fbe2dc5634625ce9175afb0881c1b9:b40cdf8a70013e2588510bd8a13ff194cc83bb2620e8fd2518bd9a08080d4776:736b696c6c732f797573756b6562652f686f6e6f2d696e6572746961:01fde7ddb1448793387d108bb8bd50ea","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 34 static findings are false positives: Markdown backticks, TypeScript template literals, documentation links, and a numeric route parameter. No evidence found of prompt injection, credential access, data exfiltration, or system reconnaissance in the reviewed skill. External dependencies and linked resources were not audited.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":57,"line_start":36},{"file":"SKILL.md","line_end":59,"line_start":57},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":70,"line_start":63},{"file":"SKILL.md","line_end":73,"line_start":70},{"file":"SKILL.md","line_end":75,"line_start":73},{"file":"SKILL.md","line_end":75,"line_start":75},{"file":"SKILL.md","line_end":88,"line_start":79},{"file":"SKILL.md","line_end":96,"line_start":88},{"file":"SKILL.md","line_end":98,"line_start":96},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":111,"line_start":110}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":116,"line_start":116},{"file":"SKILL.md","line_end":117,"line_start":117}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":118,"audit_model":"codex","audited_at":"2026-10-10T14:12:28.101+00:00","created_at":"2026-10-11T03:55:03.397631+00:00","static_findings":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Inertia.js lets you build single-page apps without writing a separate frontend or a JSON API layer. ","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Reach for this when server-rendered `hono/jsx` is no longer enough — that is, when you need client-s","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Server:** `hono` + `@hono/inertia`. The `inertia({ rootView })` middleware adds `c.render(name, ","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Client:** `@ts-76/inertia-hono-jsx`. Provides `createInertiaApp`, `<Link>`, `<Form>`, `<Head>`, ","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Bundling / SSR:** Vite (with `@cloudflare/vite-plugin` when deploying to Workers) and `vite-ssr-","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Page typing:** `@hono/inertia/vite` generates `pages.gen.ts` so `PagePropsFor<Name>` resolves to","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`yusukebe/hono-inertia-example` is the canonical layout (Hono + Inertia on Cloudflare Workers). It i","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":57,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":59,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`c.render(name, props)` returns either a full HTML document (on the first request) or a JSON Inertia","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":70,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"return pages[`./pages/${name}.tsx`]","category":"external_commands","line_end":73,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":75,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Without a custom `setup`, the adapter mounts `<App />` for you. It uses `hydrateRoot` (from `hono/js","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":88,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"<Link href={`/users/${u.id}`} key={u.id}>","category":"external_commands","line_end":96,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":98,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`PageComponent<'Users/Index'>` pulls the prop type from `pages.gen.ts`, which is generated by `@hono","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Set `jsxImportSource: \"hono/jsx\"` in `tsconfig.json`.","category":"external_commands","line_end":102,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `vite-ssr-components/hono` (not `/react`) in `root-view.tsx` to inject the Vite client and ass","category":"external_commands","line_end":103,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Deploy with `@cloudflare/vite-plugin` so `wrangler deploy` ships the SSR worker and the client bun","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `@ts-76/inertia-hono-jsx` is community-scoped and \"partial\" `hono/jsx` support per its README — br","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Asset versioning: make sure `X-Inertia-Version` matches your client bundle hash, or clients silent","category":"external_commands","line_end":111,"severity":"medium","line_start":110},{"id":"network:SKILL.md:7:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://inertiajs.com/","category":"network","line_end":7,"severity":"low","line_start":7},{"id":"network:SKILL.md:8:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://github.com/yusukebe/hono-inertia-example","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"network:SKILL.md:9:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://github.com/ts-76/inertia-hono-jsx","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://www.npmjs.com/package/@hono/inertia","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://github.com/honojs/starter/tree/main/templates/cloudflare-workers+vite","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:25:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Bundling / SSR:** Vite (with `@cloudflare/vite-plugin` when deploying to Workers) and `vite-ssr-","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<https://github.com/yusukebe/hono-inertia-example>","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"network:SKILL.md:115:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- The Inertia protocol itself — short, worth reading in full: <https://inertiajs.com/>.","category":"network","line_end":115,"severity":"low","line_start":115},{"id":"network:SKILL.md:116:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- The hono/jsx adapter API surface and typing model: <https://github.com/ts-76/inertia-hono-jsx>.","category":"network","line_end":116,"severity":"low","line_start":116},{"id":"network:SKILL.md:117:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- The example layout to copy: <https://github.com/yusukebe/hono-inertia-example>.","category":"network","line_end":117,"severity":"low","line_start":117},{"id":"blocker:SKILL.md:50:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"const id = Number(c.req.param('id'))","category":"blocker","line_end":50,"severity":"low","line_start":50}],"finding_verdicts":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The backticks format the hono/jsx package name in explanatory Markdown. No shell or Ruby execution appears here.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The backticks mark hono/jsx as inline code within usage guidance. They are documentation formatting, not executable commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"Inline backticks identify server packages and middleware APIs. The line describes Inertia rendering and does not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Backticks format client package names, components, and hooks. These are API references, not Ruby or shell expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"Backticks highlight Vite packages and a starter template name. The line contains setup guidance, not shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Backticks format the page typing plugin, generated filename, and TypeScript type. No command execution mechanism is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks identify an example repository, application files, and packages. The prose explains React adaptation, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"This is a Markdown fence enclosing TypeScript Hono routes. The enclosed code registers HTTP handlers and contains no shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown code block and format the following rendering API explanation. They are not executable syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"Inline backticks mark c.render, the middleware package, and the X-Inertia header. The text describes response selection without executing commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"This Markdown fence introduces a TSX client initialization example. The example uses a Vite module map, not a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The backticks form a TypeScript template literal used to index the Vite-generated pages map. They do not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The backticks close the TSX example and format the subsequent mount description. The match spans Markdown, not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"Backticks format setup, mounting APIs, and a rendering attribute. The line explains browser hydration and does not invoke external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"This is a Markdown fence for a TSX page component example. The component renders a user list without shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The template literal constructs a relative user link in JSX. It is ordinary TypeScript string interpolation, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The backticks close the component example and format the following type explanation. No Ruby or shell execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"Backticks highlight PageComponent, generated types, and the Vite typing plugin. The text describes build-time typing without command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"Backticks format a TypeScript configuration option and its filename. This is configuration guidance, not a shell expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"Backticks mark Hono and React import paths and a root view filename. The instruction concerns asset integration, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The line mentions wrangler deploy as a standard deployment command in Markdown. It contains no automatic invocation, injected arguments, or unauthorized deployment instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"Backticks format adapter and renderer package names in a compatibility warning. The warning recommends SSR verification and contains no shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"Backticks identify the Inertia version header and Cloudflare asset plugin. The surrounding guidance covers bundle versioning and delivery, not command substitution.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:7:hardcoded-url","reason":"The URL is a reference to Inertia documentation. No request logic, sensitive payload, or instruction to transmit data accompanies it.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:8:hardcoded-url","reason":"The URL references a public Hono Inertia example repository. It is not used as a data collection endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:9:hardcoded-url","reason":"The URL points to the client adapter repository for reference. The skill does not instruct sending credentials or project data there.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The URL is the npm package page for the documented server middleware. It contains no exfiltration payload or network execution.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:11:hardcoded-url","reason":"The URL identifies a Hono Cloudflare Workers starter template. Its use is documentary, with no sensitive data transmission.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:25:hardcoded-url","reason":"The linked Hono starter supports the described Vite and Workers setup. The line supplies a reference rather than an unauthorized network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:32:hardcoded-url","reason":"This standalone GitHub link identifies the example discussed immediately above. No request implementation or data upload instruction is present.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:115:hardcoded-url","reason":"The link recommends reading the Inertia protocol documentation. It does not instruct transmitting local files or secrets.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:116:hardcoded-url","reason":"The GitHub link is a reading reference for adapter APIs and typing. No exfiltration behavior appears in the surrounding text.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:117:hardcoded-url","reason":"The link references an example application layout. The skill provides adaptation guidance, not instructions to send private data to the repository.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:50:system-reconnaissance","reason":"The code converts a numeric HTTP route parameter into a user identifier. It does not execute the id utility or inspect system identity.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","subject_content_hash":"d5705815b3de396d0b99b31fda80c41803fbe2dc5634625ce9175afb0881c1b9","subject_tree_hash":"b40cdf8a70013e2588510bd8a13ff194cc83bb2620e8fd2518bd9a08080d4776","subject_plugin_path":"skills/yusukebe/hono-inertia","audit_payload_hash":"01fde7ddb1448793387d108bb8bd50ea","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","contentHash":"d5705815b3de396d0b99b31fda80c41803fbe2dc5634625ce9175afb0881c1b9","treeHash":"b40cdf8a70013e2588510bd8a13ff194cc83bb2620e8fd2518bd9a08080d4776","pluginPath":"skills/yusukebe/hono-inertia","auditPayloadHash":"01fde7ddb1448793387d108bb8bd50ea"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/yusukebe-hono-inertia/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}