mailchimp-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected during the analysis.
- Verification Logic: The skill provides accurate implementations for verifying Mailchimp webhooks, which do not use standard HMAC signatures. It correctly instructs users to use a shared secret in the query string and provides code using timing-safe comparison functions (
crypto.timingSafeEqualin Node.js andhmac.compare_digestin Python) to mitigate timing attacks. - URL Validation: The provided handlers correctly implement a separate GET route to answer Mailchimp's liveness check with a 200 OK response, which is necessary for registering the webhook.
- Author Context: The use of
hookdeck-cliin the documentation is consistent with the skill being authored by Hookdeck and is a standard tool for local webhook development. - Environment Management: The skill follows best practices by providing
.env.examplefiles and instructing users to generate their own random secrets rather than using hardcoded values. - Dependency Review: All identified Python and Node.js packages are standard, reputable libraries for building web servers and running tests.
Audit Metadata