postmark-webhooks
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a legitimate technical guide for integrating with Postmark's webhook system. All code examples demonstrate standard interactions with official Postmark API endpoints (api.postmarkapp.com).
- [SAFE]: Data handling patterns in the provided Node.js and Python examples follow industry standards for webhook processing, including responding with HTTP 200 immediately and using background queues for heavy processing.
- [SAFE]: The security implementation guide (references/security.md) correctly identifies and provides solutions for common webhook vulnerabilities, such as request spoofing, by detailing HTTP Basic Authentication, custom header validation, and IP allowlisting.
- [SAFE]: Use of environment variables for secrets (POSTMARK_SERVER_TOKEN, WEBHOOK_SECRET) is consistent with secure development practices. No hardcoded credentials or sensitive local file access was observed.
Audit Metadata