ordinal-webhooks
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes JSON payloads from an external webhook service, establishing an entry point for untrusted data into the agent's context.\n
- Ingestion points: Webhook endpoints are defined in
examples/nextjs/app/webhooks/ordinal/route.ts,examples/express/src/index.js, andexamples/fastapi/main.pyto receive data from tryordinal.com.\n - Boundary markers: The skill mandates authentication using a custom header secret verified via
verifyOrdinalSecret(Node.js) orverify_ordinal_secret(Python) before any data is processed.\n - Capability inventory: The provided examples are limited to logging event data to the console (
console.log,print) and do not execute file writes, subprocesses, or secondary network requests.\n - Sanitization: Standard framework JSON parsers are used to enforce payload structure, mitigating risks from malformed input.\n- [SAFE]: The skill implements security best practices for webhook authentication, including the use of constant-time comparison functions (
crypto.timingSafeEqual,hmac.compare_digest) to prevent timing attacks and fail-closed logic to prevent unauthorized access if secrets are unconfigured.
Audit Metadata