igrantio-backend-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with official iGrant.io API endpoints (
demo-api.igrant.io,staging-api.igrant.io) to register webhooks. This is consistent with the skill's purpose of integrating with the Organization Wallet Suite and follows legitimate vendor resource patterns. - [COMMAND_EXECUTION]: Signature verification for incoming webhooks is implemented using
crypto.timingSafeEqual. This is a security best practice for preventing timing-based side-channel attacks when comparing cryptographic hashes. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data via a webhook receiver. It mitigates ingestion risks by validating the HMAC signature and ensuring only supported topics are processed before storing the event data in the event store.
- [CREDENTIALS_UNSAFE]: Sensitive values, such as the OWS API key and HMAC secret key, are managed through environment variables and parameters rather than being hardcoded, adhering to standard secret management practices for backend integrations.
Audit Metadata