spree-events-webhooks
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely instructional, providing standard integration patterns and documentation for the Spree 6 event system. It is authored by the vendor and focuses on legitimate framework features such as event subscribers and outbound webhooks.
- [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill describes sending data to external URLs via webhooks, this is the primary intended functionality. It includes security guidance for implementing signature verification (HMAC-SHA256) to ensure the integrity and authenticity of these communications. It also mentions sensitive data redaction in logs (e.g., tokens, secrets) as a built-in feature of the platform.
- [INDIRECT_PROMPT_INJECTION]: The skill documents how to handle event payloads which may contain user-originated data. However, the architecture relies on the trusted Spree event bus, and the skill provides standard programmatic handling techniques without exposing dangerous execution sinks to untrusted input. The risk is consistent with standard event-driven development.
- [REMOTE_CODE_EXECUTION]: The provided code snippets are for standard Ruby and TypeScript integrations (e.g., Slack notifications, ERP syncing). The shell commands provided are standard Spree CLI generators used during development.
Audit Metadata