event-gateway
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the official Hookdeck CLI tool and downloading supplementary webhook skills from the vendor's GitHub repository (hookdeck/webhook-skills). These are recognized as official vendor resources.
- [COMMAND_EXECUTION]: The skill uses shell commands for resource management via the Hookdeck CLI, including authentication (hookdeck login, hookdeck ci), local tunneling (hookdeck listen), and project management (hookdeck project use).
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data in the form of incoming webhook payloads. 1. Ingestion points: /webhooks endpoints in Express, Next.js, and FastAPI handlers. 2. Boundary markers: HMAC signatures (x-hookdeck-signature). 3. Capability inventory: Hookdeck CLI subcommands and WebFetch for documentation. 4. Sanitization: Mandatory verification of signatures before parsing body content. The skill provides specific instructions and reference implementations to mitigate risks by enforcing these checks.
- [DYNAMIC_EXECUTION]: The skill documents the use of Hookdeck Transformations, which allow running custom JavaScript logic on the gateway to modify event payloads. It also utilizes the npx skills add command to dynamically incorporate provider-specific webhook logic.
Audit Metadata