spree-events-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructional content and code templates for building Ruby subscribers and Node/Ruby webhook receivers.
- [SAFE]: It explicitly recommends and demonstrates security best practices, including HMAC-SHA256 signature verification, the use of timing-safe comparison functions, and timestamp validation to prevent replay attacks.
- [SAFE]: The documentation mentions built-in SSRF protection (using
ssrf_filter) for webhook endpoint URLs, which is a critical security control for outbound network requests. - [SAFE]: API keys and secrets in examples are presented as placeholders (e.g., 'sk_…', 'ENV["SPREE_WEBHOOK_SECRET"]'), following safe documentation practices.
- [SAFE]: No malicious patterns such as prompt injection, obfuscation, or unauthorized data exfiltration were detected.
Audit Metadata