cronofy-webhooks

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The documentation includes shell commands for testing the webhook endpoint using curl and signing bodies via openssl for manual validation.
  • [EXTERNAL_DOWNLOADS]: The skill suggests using npx hookdeck-cli to create a local development tunnel, which downloads and executes the CLI from the npm registry.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for processing external webhook data from Cronofy. It includes a strong security boundary by implementing HMAC-SHA256 signature verification of the raw request body before JSON parsing.
  • [SAFE]: All credentials included in the documentation and test files are explicitly identified as publicly published test vector secrets provided by Cronofy.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 04:21 PM
Security Audit — agent-trust-hub — cronofy-webhooks