api-messaging-webhooks
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill provides instructional content and code templates that follow security best practices for webhook handling.- [INDIRECT_PROMPT_INJECTION]: The skill documents the handling of untrusted data from external webhook producers.
- Ingestion points: Incoming HTTP POST requests to webhook endpoints (SKILL.md, examples/core.md).
- Boundary markers: Use of HMAC-SHA256 signature verification with timing-safe comparison and timestamp validation for replay protection (examples/core.md).
- Capability inventory: Asynchronous processing of event data, typically involving task queueing or database operations (SKILL.md).
- Sanitization: Use of Zod schema validation for strict payload structural verification (examples/core.md).
Audit Metadata