webhooks
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides security-focused documentation and code examples for building webhook systems. All patterns demonstrated follow industry security standards.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture for processing external data from third-party webhook providers.\n
- Ingestion points: Example HTTP POST routes defined in SKILL.md (e.g.,
/webhooks/stripe).\n - Boundary markers: The code snippets include cryptographic signature verification (HMAC-SHA256) to ensure event source authenticity.\n
- Capability inventory: The examples show interactions with Redis for idempotency checks and task queues for asynchronous processing.\n
- Sanitization: The examples explicitly mandate verification of the raw request body against a shared secret before any processing or parsing occurs.
Audit Metadata