picqer-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates high-quality security practices for processing webhooks.
- Signature verification is correctly implemented using HMAC-SHA256.
- Timing-safe comparison methods (
crypto.timingSafeEqualandhmac.compare_digest) are used to protect against timing attacks during signature validation. - Documentation and code examples consistently emphasize verifying the 'raw' request body before any parsing occurs, preventing potential JSON serialization mismatches.
- [EXTERNAL_DOWNLOADS]: The skill utilizes standard, well-known libraries and frameworks (Express, Next.js, FastAPI).
- References to
hookdeck-clivianpxare legitimate developer tools provided by the skill's author to facilitate local webhook testing. - [CREDENTIALS_UNSAFE]: No hardcoded sensitive data was found. The skill correctly uses environment variable patterns and
.env.exampletemplates for managing secrets and API keys.
Audit Metadata