hookdeck-event-gateway
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests using
npx hookdeck-cliandnpx skills add, which download packages and tools from the NPM registry and GitHub. These resources are official components provided by the author (Hookdeck) for interacting with their service. - [INDIRECT_PROMPT_INJECTION]: This skill defines an architecture for ingesting and processing external data (webhooks) which represents a potential attack surface.
- Ingestion points: External webhook payloads from providers like Stripe, GitHub, or Shopify entering the user's application environment.
- Boundary markers: The skill documentation highlights the use of signature verification (via
x-hookdeck-signature) to ensure the authenticity of incoming data. - Capability inventory: The skill primarily provides documentation, architectural patterns, and CLI command examples. It does not contain scripts that perform file system writes or unauthorized network operations itself.
- Sanitization: The instructions explicitly recommend using the
webhook-handler-patternsskill for robust data handling, including idempotency, verification, and structured error handling.
Audit Metadata