coderabbit-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides boilerplate code for processing webhook events from CodeRabbit. It follows security best practices by implementing SHA-256 HMAC signature verification using
crypto.timingSafeEqualto prevent timing attacks and ensure the authenticity of incoming requests. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data via webhook payloads.
- Ingestion points: The webhook receiver in
SKILL.mdparses external JSON bodies from GitHub/GitLab integrations. - Boundary markers: None explicitly present in the instructional code.
- Capability inventory: The skill routes data to internal handlers for notifications and database updates.
- Sanitization: Employs signature validation to ensure the data originates from the trusted source before processing.
Audit Metadata