apps-handle-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines security-centric guidelines for handling webhooks, including HMAC-SHA256 signature verification, constant-time comparisons, and timestamp validation to prevent replay attacks.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from external webhooks. It identifies the ingestion point as the raw request body and explicitly instructs the agent to reject payloads with invalid signatures before any downstream processing or JSON parsing occurs. It also advises on redacting sensitive customer fields during diagnostics, which acts as a data sanitization step.
- [DATA_EXPOSURE]: The skill provides references to official technical documentation and schema definitions from the vendor's domain (
theapps.jp). These references are used to inform the agent of the expected payload structure and are not associated with data exfiltration.
Audit Metadata