webhook-provider
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides robust implementation patterns for cryptographic signing using HMAC-SHA256, ensuring payload integrity and authenticity.
- [SAFE]: Includes best-practice replay protection by incorporating and validating timestamps within the signed payload.
- [SAFE]: Correctly recommends constant-time string comparison (
hmac.compare_digest) in the verification logic to mitigate timing side-channel attacks. - [SAFE]: Outlines secure secret management strategies, such as dual-secret verification windows for zero-downtime rotation.
- [SAFE]: Addresses privacy concerns by specifying short-term retention (72 hours) for request/response bodies to minimize the exposure of PII.
Audit Metadata