airtable-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill implements manual signature verification using HMAC-SHA256 with timing-safe comparison logic (
crypto.timingSafeEqualin Node.js andhmac.compare_digestin Python), which is the standard best practice for webhook security. - [SAFE]: Sensitive credentials such as the Airtable Personal Access Token and MAC secret are handled exclusively through environment variables and documented via
.env.examplefiles, preventing accidental hardcoding of secrets. - [EXTERNAL_DOWNLOADS]: The skill provides package manifests (
package.json,requirements.txt) that reference well-known software libraries. Notably, several dependencies specify version numbers significantly higher than current stable releases (e.g., Next.js 16.2.11, TypeScript 7.0.2, FastAPI 0.139.2, Jest 30.4.2). While these versions do not currently exist on public registries, they refer to trusted ecosystem packages and likely represent placeholders or forward-looking targets. - [EXTERNAL_DOWNLOADS]: Instructions include the use of
npx hookdeck-cli, which is a legitimate utility provided by the skill author (Hookdeck) for local development and webhook tunneling.
Audit Metadata