lithic-webhooks

Pass

Audited by Gen Agent Trust Hub on Jul 24, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides comprehensive boilerplate for implementing Lithic webhook handlers across Express, FastAPI, and Next.js. All examples correctly prioritize raw body access, which is essential for accurate HMAC-SHA256 signature verification.
  • [SAFE]: Verification logic utilizes the official lithic SDKs and the Standard Webhooks (standardwebhooks) library, ensuring robust validation of message authenticity and protection against replay attacks via timestamp checks.
  • [SAFE]: All dependencies listed in package.json and requirements.txt files are well-known, version-pinned, and standard for the respective ecosystems (e.g., express, fastapi, dotenv).
  • [SAFE]: The use of the hookdeck-cli tool for local development is consistent with the skill's authorship and provides a legitimate utility for developers to test webhook integrations without exposing local ports manually.
  • [SAFE]: No patterns associated with prompt injection, data exfiltration, obfuscation, or unauthorized privilege escalation were identified during the analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 24, 2026, 03:53 AM
Security Audit — agent-trust-hub — lithic-webhooks