courier-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill correctly implements HMAC-SHA256 signature verification using timing-safe comparison methods (
crypto.timingSafeEqualandhmac.compare_digest) to mitigate timing attacks. - [SAFE]: Signature verification is performed against the raw request body, which is the correct security practice to ensure data integrity and avoid issues with JSON re-serialization.
- [SAFE]: The instructions and code examples prioritize security by using environment variables for sensitive credentials (the Courier signing secret).
- [EXTERNAL_DOWNLOADS]: The skill suggests using
npx hookdeck-clifor local development. This is a vendor-provided utility (matching the author 'hookdeck') fetched from the standard NPM registry. - [SAFE]: Dependency versions in the example configuration files (e.g.,
next@^16.2.11,typescript@^7.0.2,pytest>=9.1.1) appear to be placeholders or future-dated, which will cause installation failures but does not present a security risk.
Audit Metadata