langfuse-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that ingests external data from Langfuse webhooks to trigger downstream actions.
- Ingestion points: The
POSTrequest handler inapp/api/webhooks/langfuse/route.tsreceives JSON payloads from an external Langfuse instance. - Boundary markers: While no specific text boundary markers are used for the prompt data, the skill implements a strict trust boundary for the source using HMAC-SHA256 signature verification.
- Capability inventory: The integration triggers network calls to Slack and GitHub APIs via
fetch, manages an asynchronous queue usingbullmq, and can trigger GitHub Action workflows. - Sanitization: Authenticity is validated via HMAC-SHA256 signature verification using a shared secret, ensuring that only trusted payloads from the Langfuse instance are processed.
Audit Metadata