api-messaging-webhooks
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle untrusted data from external webhook providers, creating an inherent attack surface for indirect injection.
- Ingestion points: File
examples/core.mddemonstrates receiving raw request bodies from external network sources. - Boundary markers: The skill strongly enforces a trust boundary by mandating HMAC-SHA256 signature verification against the raw request body and validating timestamps to prevent replay attacks.
- Capability inventory: The provided code examples are restricted to event routing and state persistence; no subprocess execution, dynamic code evaluation, or unsafe file system operations are suggested.
- Sanitization: The skill promotes the use of the
zodlibrary for strict schema validation of all incoming payloads, ensuring that data conforms to expected types before application logic is executed.
Audit Metadata