api-webhook-integration
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle external data (webhook payloads). It correctly identifies the risk of processing untrusted data and mandates signature verification and schema validation to mitigate these risks.
- [DATA_EXPOSURE]: The provided HMAC verification script (
scripts/verify-hmac.py) accesses files and secrets for verification purposes. The script follows security best practices by using constant-time comparison (hmac.compare_digest) and does not exfiltrate data or expose file contents beyond returning a boolean validity result. - [EXTERNAL_DOWNLOADS]: The skill references documentation from well-known services (GitHub and Stripe). These are documented neutrally and serve as authoritative sources for webhook best practices.
Audit Metadata