oura-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill correctly implements HMAC-SHA256 signature verification for Oura webhooks. Examples in Express, FastAPI, and Next.js use timing-safe comparison methods (e.g.,
crypto.timingSafeEqualandhmac.compare_digest) to prevent side-channel attacks. - [SAFE]: The skill provides clear documentation on handling the subscription handshake (GET challenge) and event delivery (POST).
- [EXTERNAL_DOWNLOADS]: Example configuration files (
package.json,requirements.txt) reference version numbers for standard dependencies (e.g.,next,typescript,fastapi,pytest) that are higher than current stable releases. While these packages are from reputable sources, the use of future-dated versions may cause installation errors or represent non-standard versioning choices. - [COMMAND_EXECUTION]: Documentation suggests using
npx hookdeck-clifor local development. As the tool is provided by the skill's author (hookdeck), this is a standard and expected vendor-provided utility for integration development.
Audit Metadata