encore-go-webhook
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions for receiving webhooks using
//encore:api raw. It correctly emphasizes reading the raw request body for cryptographic signature verification before processing payloads, which is the industry standard for preventing spoofing and indirect prompt injection through webhook data. - [EXTERNAL_DOWNLOADS]: The skill references the official
github.com/stripe/stripe-golibrary for event construction. This is a well-known and trusted package from a reputable service provider. - [DATA_EXFILTRATION]: No data exfiltration patterns were detected. The code examples demonstrate handling inbound data and responding with standard HTTP status codes or enqueuing events via internal Pub/Sub mechanisms.
- [CREDENTIALS_UNSAFE]: The skill demonstrates safe secret management by instructing users to use the
secretsstruct (referencing a separate dedicated skill) rather than hardcoding keys or tokens in the source code.
Audit Metadata