webhook-signature-validator
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to handle and validate external webhook data, creating a potential surface for indirect prompt injection.
- Ingestion points: Webhook payloads and signatures processed during validator operations, as described in
SKILL.md. - Boundary markers: Absent. The instructions do not specify the use of delimiters or explicit guardrails to ignore instructions embedded within external webhook content.
- Capability inventory: The skill is configured with broad access to the execution environment via
Bash(cmd:*),Write,Edit, andReadtools as defined in theSKILL.mdfrontmatter. - Sanitization: Absent. The instructions focus on signature verification but do not provide guidance for sanitizing or escaping the data content itself before the agent processes it.
Audit Metadata