cronofy-webhooks
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation includes shell commands for testing the webhook endpoint using
curland signing bodies viaopensslfor manual validation. - [EXTERNAL_DOWNLOADS]: The skill suggests using
npx hookdeck-clito create a local development tunnel, which downloads and executes the CLI from the npm registry. - [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for processing external webhook data from Cronofy. It includes a strong security boundary by implementing HMAC-SHA256 signature verification of the raw request body before JSON parsing.
- [SAFE]: All credentials included in the documentation and test files are explicitly identified as publicly published test vector secrets provided by Cronofy.
Audit Metadata