webhook-verifier
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill references local utility scripts (
scripts/sign-event.js) and repository-level commands (npm run generate:signatures) used for generating signed test events and updating the provider signature catalog. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted external data by providing instructions for generating webhook handlers.
- Ingestion points: Raw request bodies from incoming webhooks processed in multiple frameworks (Next.js, Express, FastAPI, Laravel, Rails).
- Boundary markers: The instructions mandate a rigid "Verification Contract" that enforces cryptographic signature checks before the generated code parses or trusts the payload.
- Capability inventory: Handlers are instructed to perform HMAC-SHA256 verification, with some providers (e.g., Mercado Pago, Wompi) requiring secondary API requests to re-fetch authoritative records.
- Sanitization: The skill incorporates defensive logic including a 256KB body size limit to prevent resource exhaustion and prohibits logging full payloads to avoid accidental data exposure.
Audit Metadata