github-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing external GitHub webhook payloads, representing a standard entry point for untrusted data. * Ingestion points: POST endpoints in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/github/route.ts. * Boundary markers: Employs X-Hub-Signature-256 verification as a trust boundary. * Capability inventory: The handlers currently perform logging; documentation indicates potential for automation. * Sanitization: Comprehensive verification logic is provided to authenticate incoming requests.
- [EXTERNAL_DOWNLOADS]: The documentation references the vendor's hookdeck-cli tool for local development and testing of webhook tunnels. * Evidence: Recommendations to use npx hookdeck-cli for testing in project READMEs and references.
Audit Metadata