webhook-verifier
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed as a security reference for payment integrations. It correctly instructs the agent to use raw request bodies for verification, avoid parsing JSON beforehand, and employ timing-safe equality checks to prevent side-channel attacks.
- [SAFE]: Guidance on environment variable management is provided, specifically advising developers to verify that .env files are excluded from version control.
- [SAFE]: Replay protection strategies (timestamp windows and event-id deduplication) are accurately documented for each supported provider.
- [SAFE]: No malicious patterns such as prompt injection, data exfiltration, or unauthorized command execution were detected. The skill uses the 'Read' tool exclusively for internal reference.
Audit Metadata