solidgate-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive and secure implementation examples for Node.js (Express, Next.js) and Python (FastAPI), focusing on the critical task of webhook signature verification.
- [SAFE]: Cryptographic implementations correctly use HMAC-SHA512 with the merchant's secret key and wrap the raw body with the public key as required by the Solidgate protocol.
- [SAFE]: The code utilizes timing-safe equality checks, specifically crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python, to protect against timing side-channel attacks during verification.
- [SAFE]: All external tool references, such as hookdeck-cli, are official resources belonging to the vendor (hookdeck) and are used for legitimate development purposes like local tunneling.
- [SAFE]: Sensitive configuration is handled via environment variable placeholders, and no credentials or private keys are hardcoded in the skill files.
- [SAFE]: Data handling is restricted to logging specific event metadata, with no evidence of dangerous dynamic execution or system-level access being granted to the processed payloads.
Audit Metadata