webhook-receiver-hardener
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides logic for receiving and processing external data via webhook endpoints.
- Ingestion points: The implementation examples in
SKILL.mddefinerouter.posthandlers that ingest external payloads from third-party providers like Stripe. - Boundary markers: The skill provides robust boundary markers by teaching the mandatory use of signature verification (HMAC-SHA256) and early payload validation before any data is processed.
- Capability inventory: The code snippets demonstrate interactions with databases and Redis for tracking processed IDs. There are no functions that perform command execution, file system modifications, or unsafe network operations based on the input data.
- Sanitization: The skill emphasizes rejecting malformed or unverified requests with appropriate 400/401 status codes, minimizing the attack surface.
- [SAFE]: The code snippets follow security best practices, such as using
crypto.timingSafeEqualto prevent timing attacks and sourcing secrets from environment variables (process.env.STRIPE_WEBHOOK_SECRET).
Audit Metadata