aircall-webhooks
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly identifies and implements Aircall's token-based verification mechanism. It provides implementation examples using constant-time comparisons (crypto.timingSafeEqual in Node.js and secrets.compare_digest in Python) to protect against timing attacks that could reveal the shared secret.
- [PROMPT_INJECTION]: While the skill processes external webhook data, the provided implementation logic is defensive and does not expose a significant indirect prompt injection surface. The handlers are restricted to logging and event dispatching based on a verified token, with no evidence of downstream command execution or unsafe interpolation into agent prompts.
- [EXTERNAL_DOWNLOADS]: The skill mentions the hookdeck-cli for local testing. This is an official tool provided by the vendor (Hookdeck) and is used for tunnel creation and event inspection in a development context.
- [SAFE]: The provided code examples follow industry best practices for webhook handling, including returning a 200 OK response immediately to meet Aircall's 5-second timeout requirement and recommending idempotent processing for at-least-once delivery semantics.
Audit Metadata