persona-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for ingesting external data via webhooks. It addresses this risk by implementing robust HMAC-SHA256 signature verification using
crypto.timingSafeEqualto validate that requests originate from a trusted source before the payload is parsed or processed. - [DATA_EXPOSURE_AND_EXFILTRATION]: The implementation follows security best practices by retrieving sensitive webhook secrets from environment variables (
process.env.PERSONA_WEBHOOK_SECRET) rather than hardcoding credentials. - [EXTERNAL_DOWNLOADS]: The skill references official developer documentation on the
withpersona.comdomain, which is a well-known service for identity verification.
Audit Metadata