oura-webhooks

Pass

Audited by Gen Agent Trust Hub on Jul 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill correctly implements HMAC-SHA256 signature verification for Oura webhooks. Examples in Express, FastAPI, and Next.js use timing-safe comparison methods (e.g., crypto.timingSafeEqual and hmac.compare_digest) to prevent side-channel attacks.
  • [SAFE]: The skill provides clear documentation on handling the subscription handshake (GET challenge) and event delivery (POST).
  • [EXTERNAL_DOWNLOADS]: Example configuration files (package.json, requirements.txt) reference version numbers for standard dependencies (e.g., next, typescript, fastapi, pytest) that are higher than current stable releases. While these packages are from reputable sources, the use of future-dated versions may cause installation errors or represent non-standard versioning choices.
  • [COMMAND_EXECUTION]: Documentation suggests using npx hookdeck-cli for local development. As the tool is provided by the skill's author (hookdeck), this is a standard and expected vendor-provided utility for integration development.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 24, 2026, 03:54 AM
Security Audit — agent-trust-hub — oura-webhooks