creating-webhook-handlers
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides secure implementation patterns for webhook processing, including HMAC-SHA256 verification and idempotency guards.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data via webhook endpoints, which constitutes a common attack surface.
- Ingestion points: The skill instructions and examples (e.g.,
routes/webhooks.js) demonstrate how to capture external request bodies from various providers. - Boundary markers: The skill explicitly instructs the agent to implement robust signature verification using
crypto.timingSafeEqualand provider-specific secret keys, ensuring only authentic payloads are processed. - Capability inventory: The skill uses standard file manipulation tools (
Read,Write,Edit) and a scoped shell tool (Bash(api:webhook-*)) for project setup. - Sanitization: Webhook payloads are cryptographically verified and validated against expected schemas before being passed to internal handlers or task queues.
Audit Metadata