Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jeremylongshore/hex-security-basics
Apply Hex security best practices for secrets and access control.
Passed 21 of 22 test cases with the skill, and 14 of 22 without it.
and 5 more in the full report
8 fixed15 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
When writing a schema to validate Hex project execution requests, what string format constraint must be enforced on the `project_id` property?
| Checked | Without skill | With skill |
|---|---|---|
| Validates project_id with Zod uuid constraint. | Missed | Passed |
The instructions your model reads when the skill loads.
Hex is a collaborative data analytics platform where notebooks query production databases, generate visualizations, and share results across teams. Security concerns center on API token management (read vs run scopes), protecting database connection credentials embedded in Hex projects, and ensuring query results containing sensitive business data are not leaked through logs or exports. A compromised run-scope token can trigger arbitrary queries against connected databases.
function createHexClient(scope: "read" | "run"): { token: string; baseUrl: string } {
const envVar = scope === "run" ? "HEX_RUN_TOKEN" : "HEX_READ_TOKEN";
const token = process.env[envVar];
if (!token) {
throw new Error(`Missing ${envVar} — store in secrets manager, never in code`);
}
// Run tokens can trigger queries — use read tokens for monitoring
console.log(`Hex client initialized with ${scope} scope (token suffix: ${token.slice(-4)})`);
return { token, baseUrl: "https://app.hex.tech/api/v1" };
}
import crypto from "crypto";
import { Request, Response, NextFunction } from "express";
function verifyHexWebhook(req: Request, res: Response, next: NextFunction): void {
const signature = req.headers["x-hex-signature"] as string;
const secret = process.env.HEX_WEBHOOK_SECRET!;
const expected = crypto.createHmac("sha256", secret).update(req.body).digest("hex");
if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
res.status(401).send("Invalid signature");
return;
}
next();
}
test cases passed, vs 14 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.