ops-webhook-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill files consist of a basic Python scaffold and documentation for a webhook analyzer. No evidence of credential theft, obfuscation, or unauthorized network activity was found.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external structured data (JSON/CSV), which creates an attack surface for indirect prompt injection if the output is interpreted by an LLM.
- Ingestion points: The
run.pyscript reads input data from a file path specified by the--inputargument. - Boundary markers: The implementation does not include specific boundary markers or instructions to isolate potentially malicious commands embedded in the input data.
- Capability inventory: The script's capabilities are restricted to reading the input file and writing the processed keys to an output file. There are no subprocess calls, network requests, or dynamic execution functions.
- Sanitization: The script parses the input as JSON but does not perform additional validation or sanitization of the content.
Audit Metadata