aws-sns-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill implements robust signature verification for all incoming AWS SNS message types, ensuring authenticity before processing any payload data.
- [EXTERNAL_DOWNLOADS]: Fetches AWS public X.509 certificates from official AWS domains (e.g., sns.us-east-1.amazonaws.com) to perform RSA verification of message signatures. This process includes strict hostname validation to prevent certificate redirection attacks.
- [EXTERNAL_DOWNLOADS]: Automatically confirms subscriptions by issuing a GET request to the SubscribeURL provided in SubscriptionConfirmation messages, which is the standard and expected behavior for SNS webhook handshakes.
- [DATA_EXFILTRATION]: No unauthorized data exfiltration patterns were detected. Incoming webhook data is processed locally within the handler, and no sensitive information is sent to third-party domains.
- [REMOTE_CODE_EXECUTION]: No remote code execution vulnerabilities were found. The skill avoids using unsafe functions like eval() or exec() and performs thorough verification before acting on external input.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets were detected. The skill correctly utilizes environment variables for configuration and sensitive data management.
Audit Metadata