salesloft-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external Salesloft webhook deliveries, which constitutes an ingestion point for untrusted data. Ingestion points: Webhook request bodies and headers (x-salesloft-event, x-salesloft-signature) as described in SKILL.md. Boundary markers: The skill explicitly instructs to verify the SHA-1 HMAC signature using a secret callback token before any JSON parsing or processing occurs. Capability inventory: The skill utilizes tool access for Read, Glob, Grep, WebFetch, Write, and Edit. Sanitization: Implements mandatory constant-time HMAC comparison and callback token validation to ensure payload integrity and authenticity.
Audit Metadata