google-pubsub-webhooks
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements best practices for webhook security by using Google's official auth libraries (
google-auth-libraryandgoogle-auth) to verify OIDC JWT signatures, issuers, and audiences before processing any request data. - [EXTERNAL_DOWNLOADS]: Dependencies listed in
package.jsonandrequirements.txtare well-known, official libraries from trusted sources (Google, Vercel, etc.) and established frameworks. Documentation for local development referenceshookdeck-cli, which is the official tool of the skill's author. - [CREDENTIALS_UNSAFE]: No hardcoded secrets or sensitive credentials were detected. Environment variable examples use placeholders and provide clear instructions for secure configuration.
- [REMOTE_CODE_EXECUTION]: No dangerous patterns such as
eval(),exec(), or piping remote scripts to a shell were found. The implementation focuses strictly on JSON parsing and Base64 decoding of message payloads.
Audit Metadata