flexport-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard implementation guidance for a web service. It correctly demonstrates security best practices such as:
- Using HMAC-SHA256 signature verification with
crypto.timingSafeEqualto prevent timing attacks. - Managing secrets via environment variables (
process.env.FLEXPORT_WEBHOOK_SECRET) rather than hardcoding credentials. - Implementing idempotency checks to handle network retries safely.
- Filtering sensitive data from logs.
- Using HMAC-SHA256 signature verification with
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data (Flexport webhooks). However, it includes strong validation (signature verification) and structured parsing, which effectively mitigates the risk of processing unauthorized or malicious payloads.
Audit Metadata