webhook-setup
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides robust implementations for webhook security, including HMAC-SHA256 signature verification to authenticate incoming requests from providers like Stripe and GitHub.- [SAFE]: The code examples utilize constant-time comparison functions (e.g., crypto.timingSafeEqual and hmac.compare_digest) to mitigate potential timing attacks during authentication.- [SAFE]: Database interactions are performed using parameterized queries, effectively preventing SQL injection risks.- [PROMPT_INJECTION]: The skill handles untrusted data from external webhooks. While it presents a potential indirect prompt injection surface, it includes mandatory security controls:
- Ingestion points: Incoming webhook request bodies in the provided code templates (SKILL.md).
- Boundary markers: HMAC signature verification is implemented as a strict boundary to validate payloads before processing.
- Capability inventory: Capabilities include database writes (PostgreSQL) and background task execution (BullMQ, FastAPI tasks).
- Sanitization: Cryptographic verification ensures only authentic data from trusted sources is handled, preventing malicious external instructions from reaching the agent.- [SAFE]: Replay attacks are addressed through timestamp verification logic that rejects excessively old events.
Audit Metadata