igrantio-verifier-backend
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a tenant-aware reverse proxy that strictly adheres to a least-privilege model. Only a specific allow-list of verification-related endpoints (v2/v3 send and history) is permitted, preventing unauthorized access to other upstream OWS APIs.
- [SAFE]: Webhook security is maintained through mandatory HMAC-SHA256 signature verification. The implementation uses
timingSafeEqualfor constant-time comparison, effectively mitigating timing attacks during authentication. - [SAFE]: Credential management follows standard security patterns. API keys are resolved from environment variables and kept strictly server-side, ensuring they are never exposed to the frontend browser context.
- [SAFE]: The skill uses Server-Sent Events (SSE) and an in-memory event store with a cleanup mechanism to manage event lifecycle safely and prevent memory exhaustion from stale data.
Audit Metadata