square-webhooks
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard implementation examples for Square webhook verification, emphasizing raw body processing and constant-time signature comparison.
- [EXTERNAL_DOWNLOADS]: The examples reference official packages and standard web frameworks. The package names match official libraries, and the provided version numbers, while unusually high, do not indicate malicious typosquatting.
- [COMMAND_EXECUTION]: The documentation includes instructions for using the
hookdeck-clifor local development. This is a legitimate tool provided by the skill's author to facilitate webhook testing. - [DATA_EXFILTRATION]: No sensitive data exposure or unauthorized network operations were identified. The environment variable examples use placeholders, and the signature verification process is used to authenticate incoming data.
Audit Metadata