sent-webhook-engineer
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides detailed, correct instructions for implementing HMAC-SHA256 signature verification, including requirements for raw body handling and constant-time comparisons to prevent timing attacks.
- [SAFE]: The reference script (
scripts/verify_signature.py) and framework recipes correctly use environment variables for secret management and implement industry-standard replay protection using a 300-second timestamp window. - [SAFE]: The instructions explicitly identify the risk of indirect prompt injection and command injection, directing users to treat all incoming webhook payload values as untrusted and requiring proper escaping before use in downstream systems.
- [SAFE]: The skill follows least-privilege principles by suggesting the use of separate webhook registrations for development and production environments to prevent cross-environment failures.
Audit Metadata