commercelayer-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides best-practice implementation patterns for HMAC-SHA256 signature verification of Commerce Layer webhooks. It correctly emphasizes using raw request bodies to avoid signature mismatches caused by re-serialization.
- [EXTERNAL_DOWNLOADS]: The skill recommends using
hookdeck-clifor local development and testing. This is a tool provided by the skill's author (Hookdeck) to facilitate webhook tunneling. - [COMMAND_EXECUTION]: Example files include commands for installing dependencies and running local servers (e.g.,
npm install,pip install,uvicorn). These are standard development tasks for the provided examples. - [CREDENTIALS_UNSAFE]: Environment variable examples and documentation use placeholders (e.g.,
your_webhook_shared_secret_here) for sensitive values, following standard security practices for secret management.
Audit Metadata