linear-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data originating from Linear webhooks.
- Ingestion points: The skill ingests raw HTTP request bodies in the Express, FastAPI, and Next.js examples (SKILL.md, references/implementation-guide.md, references/implementation.md).
- Boundary markers: The skill explicitly mandates and implements HMAC-SHA256 signature verification using the
Linear-Signatureheader and a shared secret. It also includes timestamp verification to prevent replay attacks. - Capability inventory: Handlers perform logging, Slack notifications via
fetch, and database synchronization. - Sanitization: Cryptographic verification is used as the primary gatekeeper for data integrity and authenticity.
- [COMMAND_EXECUTION]: The skill includes instructions for using
ngrokto facilitate local development. - The
ngrokutility is used to create secure tunnels for testing webhook delivery on a local machine, which is a standard industry practice for this type of integration.
Audit Metadata