clerk-webhooks
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides robust examples for Clerk webhook signature verification across multiple frameworks. This implementation ensures that only authentic requests from Clerk are processed by the user's application.
- [SAFE]: All provided code samples include logic to validate the 'svix-timestamp' header, rejecting requests older than 300 seconds (5 minutes) to protect against replay attacks.
- [EXTERNAL_DOWNLOADS]: The documentation suggests installing the Hookdeck CLI via Homebrew (
brew install hookdeck/hookdeck/hookdeck) to facilitate local testing and tunneling. This is a legitimate developer tool provided by the skill's author (hookdeck) and is relevant to the skill's intended purpose.
Audit Metadata