webhook-setup
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses official developer tools from the vendor (Meta Social Technologies) to manage webhook subscriptions. All tool invocations and URL references point to trusted vendor domains (facebook.com, github.com/facebook).
- [SAFE]: The workflow follows standard industry practices for webhook setup, including callback URL verification and the use of shared secret tokens provided by the user.
- [SAFE]: Telemetry tracking is explicitly implemented as part of the tool's lifecycle (devtools_skill_invocation), which is transparently documented in the skill instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface as it ingests user-provided strings (App ID, topics, tokens) and interpolates them into tool calls. However, these are specialized API tools for a specific administrative task, not generic code execution environments, and the usage is consistent with the primary skill purpose.
Audit Metadata