clay-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The implementation patterns use HMAC SHA-256 signature verification with timing-safe comparisons to ensure the authenticity of incoming requests.
- [SAFE]: Authentication secrets and webhook URLs are managed through environment variables, avoiding hardcoded credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from webhooks; however, it includes security guidelines for validating payloads and restricting the transmission of sensitive data, mitigating potential injection risks from untrusted sources.
- [COMMAND_EXECUTION]: The skill provides examples of using
curlfor administrative API tasks like webhook registration, which is consistent with the intended functionality and targets legitimate service endpoints.
Audit Metadata