customerio-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly implements HMAC-SHA256 signature verification using
crypto.timingSafeEqualto validate that incoming webhooks originate from Customer.io, preventing spoofing attacks. - [SAFE]: Sensitive information such as API keys and webhook secrets are handled via environment variables (
process.env), which is the recommended practice for credential management. - [SAFE]: External dependencies referenced (e.g.,
customerio-node,bullmq,@google-cloud/bigquery) are well-known, legitimate packages consistent with the skill's stated purpose of handling SaaS events and data streaming. - [SAFE]: Network operations are directed at the official Customer.io API (
api.customer.io), which is a well-known and expected service for this implementation.
Audit Metadata