praxis-webhooks
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements robust security practices by requiring SHA-384 signature verification on all incoming webhook requests before processing the data.
- [SAFE]: Cryptographic comparisons in both Node.js (
crypto.timingSafeEqual) and Python (hmac.compare_digest) implementations use timing-safe methods to mitigate timing-based side-channel attacks. - [SAFE]: Sensitive information, specifically the
PRAXIS_MERCHANT_SECRET, is managed through environment variables as demonstrated in the.env.examplefiles and source code, preventing hardcoded credential exposure. - [SAFE]: The recommended development tools and repository references (e.g.,
hookdeck-cli,github.com/hookdeck/webhook-skills) originate from the skill's author, Hookdeck, representing legitimate vendor functionality for webhook debugging and tunneling.
Audit Metadata