payuni-webhook
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements and encourages strong security practices for webhook handling, including signature verification using SHA256 and constant-time comparisons.
- [SAFE]: Signature verification correctly utilizes
crypto.timingSafeEqualto mitigate potential timing attacks during authentication. - [SAFE]: Replay attack prevention is addressed by providing SQL schemas and logic for tracking processed transactions in a database.
- [SAFE]: Secret management is handled correctly by instructing users to use environment variables (
process.env.PAYUNI_HASH_KEY,process.env.PAYUNI_HASH_IV) rather than hardcoding sensitive credentials. - [SAFE]: No malicious patterns such as prompt injection, obfuscation, or unauthorized data exfiltration were detected. External tools like ngrok are mentioned strictly for legitimate local development testing.
Audit Metadata