klingai-webhook-config
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external webhook events, which is an inherent part of its functionality.
- Ingestion points: Webhook endpoints defined in
SKILL.mdandreferences/implementation.md(e.g.,/webhooks/klingai) ingest JSON data from the Kling AI service. - Boundary markers: The instructions explicitly mandate validating the
X-Kling-Signatureheader using HMAC SHA-256 to ensure data authenticity. - Capability inventory: Code templates provide hooks for downloading videos, updating databases, and notifying users, which are common event-driven actions.
- Sanitization: The skill includes instructions to enforce schema validation and least-privilege routing to mitigate the risk of malicious payload content.
- [CREDENTIALS_UNSAFE]: The skill demonstrates safe secret management by instructing the use of environment variables (
KLING_ACCESS_KEY,KLING_SECRET_KEY,KLINGAI_WEBHOOK_SECRET) for API authentication and signature verification, rather than hardcoding secrets. - [EXTERNAL_DOWNLOADS]: The skill interacts with the official Kling AI API (
api.klingai.com) for task management and webhook registration, which is the intended purpose of the skill. - [COMMAND_EXECUTION]: The skill provides standard implementation examples for Flask and Express.js servers intended for the developer to run in their own environment.
Audit Metadata