webhook-system
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is an educational guide and reference implementation for building a backend webhook system. It does not contain executable malicious code or instructions to bypass safety filters.
- [SAFE]: Phase 3 (Signing) explicitly instructs the use of
timingSafeEqualto prevent timing attacks, which is a standard security best practice for signature verification. - [SAFE]: The skill includes instructions for preventing replay attacks by including and verifying a timestamp in the signature headers.
- [SAFE]: Phase 7 (Non-obvious failure modes) provides proactive security advice, specifically recommending SSRF protection by validating that delivery URLs do not resolve to private IP ranges.
- [SAFE]: The code snippets use standard Node.js built-in modules (such as
crypto) and standard Web APIs (fetch,AbortSignal). No untrusted external dependencies or remote script execution patterns were detected.
Audit Metadata