commercelayer-webhooks

Pass

Audited by Gen Agent Trust Hub on Jul 24, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides best-practice implementation patterns for HMAC-SHA256 signature verification of Commerce Layer webhooks. It correctly emphasizes using raw request bodies to avoid signature mismatches caused by re-serialization.
  • [EXTERNAL_DOWNLOADS]: The skill recommends using hookdeck-cli for local development and testing. This is a tool provided by the skill's author (Hookdeck) to facilitate webhook tunneling.
  • [COMMAND_EXECUTION]: Example files include commands for installing dependencies and running local servers (e.g., npm install, pip install, uvicorn). These are standard development tasks for the provided examples.
  • [CREDENTIALS_UNSAFE]: Environment variable examples and documentation use placeholders (e.g., your_webhook_shared_secret_here) for sensitive values, following standard security practices for secret management.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 24, 2026, 03:53 AM
Security Audit — agent-trust-hub — commercelayer-webhooks