juicebox-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle external data via webhooks, creating a surface for potential indirect prompt injection. However, it incorporates robust security controls.
- Ingestion points: Webhook endpoints defined in SKILL.md and references/implementation-guide.md ingest JSON payloads from the Juicebox API.
- Boundary markers: The instructions explicitly mandate origin authentication and validation of event IDs and timestamps before parsing payloads.
- Capability inventory: The skill utilizes tools such as Read, Write, Edit, and Grep, and the implementation code demonstrates database updates and notification triggers.
- Sanitization: The skill provides complete code examples for verifying x-juicebox-signature headers using HMAC-SHA256 with crypto.timingSafeEqual to ensure data integrity and authenticity.
Audit Metadata