mailgun-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly implements Mailgun's signature verification scheme, which involves HMAC-SHA256 hashing of concatenated timestamp and token values.
- [SAFE]: All provided implementation examples (Node.js, Express, Next.js, FastAPI) utilize timing-safe string comparison functions (crypto.timingSafeEqual and hmac.compare_digest) to prevent side-channel attacks.
- [SAFE]: The documentation provides comprehensive guidance on production security measures, including the use of unique tokens for idempotency and replay protection.
- [SAFE]: External dependencies referenced in the examples are standard industry libraries, and the recommended CLI tool (hookdeck-cli) is a legitimate resource provided by the skill's author.
Audit Metadata