alchemy-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Implements best-practice security patterns for webhook signature verification, utilizing timing-safe comparisons (such as
crypto.timingSafeEqualandhmac.compare_digest) to mitigate potential timing attacks. - [SAFE]: Provides clear instructions for managing sensitive configuration, like the
ALCHEMY_SIGNING_KEY, via environment variables and.envfiles rather than hardcoding credentials. - [EXTERNAL_DOWNLOADS]: Mentions the use of
npx hookdeck-clifor local development and testing. This utility is provided by the skill's author and represents a standard developer tool for tunneling webhooks.
Audit Metadata