skills/jeremylongshore/claude-code-plugins-plus-skills/creating-webhook-handlers/Gen Agent Trust Hub
creating-webhook-handlers
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions and boilerplate for implementing HMAC signature verification, which is the industry standard for securing webhooks from unauthorized senders.
- [SAFE]: The implementation examples correctly use express.raw() to capture the raw request body, which is necessary for accurate HMAC calculation and prevents potential discrepancies caused by default JSON parsing.
- [SAFE]: The skill promotes the use of constant-time comparison via crypto.timingSafeEqual to mitigate side-channel timing attacks.
- [SAFE]: Secret keys are correctly managed via environment variables rather than hardcoded in the skill or the generated code.
- [SAFE]: References to external documentation are restricted to official sources (GitHub, Stripe) and standard specifications (RFC 2104).
Audit Metadata