lithic-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive boilerplate for implementing Lithic webhook handlers across Express, FastAPI, and Next.js. All examples correctly prioritize raw body access, which is essential for accurate HMAC-SHA256 signature verification.
- [SAFE]: Verification logic utilizes the official
lithicSDKs and the Standard Webhooks (standardwebhooks) library, ensuring robust validation of message authenticity and protection against replay attacks via timestamp checks. - [SAFE]: All dependencies listed in
package.jsonandrequirements.txtfiles are well-known, version-pinned, and standard for the respective ecosystems (e.g.,express,fastapi,dotenv). - [SAFE]: The use of the
hookdeck-clitool for local development is consistent with the skill's authorship and provides a legitimate utility for developers to test webhook integrations without exposing local ports manually. - [SAFE]: No patterns associated with prompt injection, data exfiltration, obfuscation, or unauthorized privilege escalation were identified during the analysis.
Audit Metadata