bridge-xyz-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill correctly implements RSA-SHA256 signature verification across all provided language examples, ensuring that incoming webhook payloads are authentic and have not been tampered with.
- [SAFE]: A replay protection mechanism is implemented by checking the signature timestamp against a 10-minute tolerance window, preventing old events from being reprocessed.
- [EXTERNAL_DOWNLOADS]: The skill utilizes standard, reputable libraries from official registries (NPM and PyPI). It also references the vendor's official CLI tool (hookdeck-cli) for secure local tunneling during development.
- [DATA_EXFILTRATION]: No evidence of data exfiltration or unauthorized network communication was found. The skill follows best practices for secret management by instructing users to store keys in environment variables.
Audit Metadata