zendesk-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation suggests using
npx hookdeck-clito test webhooks locally. This fetches the Hookdeck CLI tool, which is maintained by the skill's author. - [REMOTE_CODE_EXECUTION]: The skill includes instructions to run
npx hookdeck-cli, which involves downloading and executing code from the npm registry at runtime for local development and testing purposes. - [PROMPT_INJECTION]: The skill provides templates for webhook handlers that ingest external JSON data. While the examples demonstrate secure signature verification and safe data handling (logging), the ingestion of external data constitutes a surface for indirect prompt injection.
- Ingestion points:
/webhooks/zendeskroute inexamples/express/src/index.js,examples/fastapi/main.py, andexamples/nextjs/app/webhooks/zendesk/route.ts. - Boundary markers: None explicitly mentioned for the agent context.
- Capability inventory: Logging and conditional dispatching based on payload type.
- Sanitization: Payloads are parsed using standard JSON libraries.
Audit Metadata