bridge-api-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates secure webhook handling by requiring HMAC-SHA256 signature verification before processing incoming payloads, preventing unauthorized data injection.- [SAFE]: Implementation examples for Node.js, Python, and Next.js correctly use timing-safe comparison functions such as crypto.timingSafeEqual and hmac.compare_digest to protect against timing side-channel attacks.- [SAFE]: The instructions correctly emphasize using the raw request body for verification to ensure that framework-level parsing does not alter whitespace or key ordering, which would invalidate the signature check.- [SAFE]: Sensitive configuration, such as the webhook signing secret, is managed via environment variables and .env.example files, adhering to best practices for secret management.
Audit Metadata