Linear Webhooks (Verify, Replay, DLQ)
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation follows security best practices for webhook integrations, including constant-time signature verification using node:crypto and replay protection using timestamp windows.
- [INDIRECT_PROMPT_INJECTION]: Although the skill describes processing external data from Linear webhooks, it includes robust verification steps (HMAC-SHA256) and recommends re-fetching authoritative state from an API, which significantly reduces the risk of processing malicious payloads.
- [CREDENTIALS_SAFE]: No hardcoded secrets were found; the skill correctly instructs users to manage webhook secrets and rotate them periodically.
- [COMMAND_EXECUTION]: While the frontmatter scopes the skill to include the Bash tool, no instructions were found that execute dangerous shell commands or pipe unvalidated external data to a shell.
Audit Metadata