clio-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows secure implementation patterns for webhook processing across all provided examples.
- [SAFE]: Signature Verification: Implements HMAC-SHA256 verification using timing-safe comparison (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing attacks.
- [SAFE]: Data Integrity: All examples correctly use raw request bodies for signature calculation, ensuring that verification does not fail due to JSON re-serialization differences.
- [SAFE]: Handshake Protocol: The logic properly identifies and responds to the Clio activation handshake (X-Hook-Secret) before attempting signature verification or payload processing.
- [SAFE]: Dependency Management: The skill references standard, well-known libraries for its functionality. While some version numbers in the examples (e.g., Next.js 16, TypeScript 7) appear to be future-dated placeholders, they refer to legitimate and trusted packages.
- [SAFE]: Tooling: Recommends the official 'hookdeck-cli' for local development, which is a verified tool from the skill's author.
Audit Metadata