webhook-handling
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes patterns for ingesting untrusted data from external sources (webhooks).
- Ingestion points: Data enters the system via the
receiveactions inGithubControllerandStripeControllerdefined inSKILL.md. - Boundary markers: The skill implements strong boundary controls through mandatory HMAC signature verification and timestamp-based replay protection (for Stripe).
- Capability inventory: The ingested payload is persisted to a database (
WebhookEvent) and then processed by background workers (ProcessGithubEventJob), which may interact with other system components. - Sanitization: The skill recommends using Active Record Encryption for any data containing PII stored in the database.
Audit Metadata