webhook-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and reference code for implementing webhooks. All code samples follow industry-standard security practices, such as using HMAC with SHA-256 for request signatures.
- [SAFE]: The webhook receiver implementation in
references/webhook-receiver-express.mdcorrectly usescrypto.timingSafeEqualto protect against timing attacks during signature verification. - [SAFE]: Sensitive configuration, such as webhook secrets, is handled correctly via environment variables (e.g.,
process.env.WEBHOOK_SECRET) in the provided examples rather than being hardcoded. - [SAFE]: The CI/CD template and validation script provided are basic scaffolds and do not contain any suspicious commands, exfiltration logic, or unauthorized access patterns.
- [SAFE]: External libraries referenced in the code (axios, express, bull, express-validator) are reputable and standard within the Node.js ecosystem.
Audit Metadata