zendesk-webhooks

Pass

Audited by Gen Agent Trust Hub on Jul 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation suggests using npx hookdeck-cli to test webhooks locally. This fetches the Hookdeck CLI tool, which is maintained by the skill's author.
  • [REMOTE_CODE_EXECUTION]: The skill includes instructions to run npx hookdeck-cli, which involves downloading and executing code from the npm registry at runtime for local development and testing purposes.
  • [PROMPT_INJECTION]: The skill provides templates for webhook handlers that ingest external JSON data. While the examples demonstrate secure signature verification and safe data handling (logging), the ingestion of external data constitutes a surface for indirect prompt injection.
  • Ingestion points: /webhooks/zendesk route in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/zendesk/route.ts.
  • Boundary markers: None explicitly mentioned for the agent context.
  • Capability inventory: Logging and conditional dispatching based on payload type.
  • Sanitization: Payloads are parsed using standard JSON libraries.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 24, 2026, 03:54 AM
Security Audit — agent-trust-hub — zendesk-webhooks