posthog-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly instructs users to use environment variables (e.g.,
POSTHOG_PERSONAL_API_KEY,POSTHOG_WEBHOOK_SECRET) for managing sensitive credentials instead of hardcoding them. - [SAFE]: The code examples for receiving webhooks implement security best practices, including HMAC-SHA256 signature verification using timing-safe comparisons to prevent timing attacks.
- [SAFE]: Network communications are limited to well-known and expected services (PostHog, HubSpot, and Slack) consistent with the skill's described functionality.
Audit Metadata