terra-unified-api
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive guidelines for secure integration with the Terra API, focusing on production reliability and data integrity.
- [SAFE]: Rule
webhooks-verify-raw-body.mdmandates that developers verify theterra-signature(orX-Terra-Signature) HMAC-SHA256 signature using the raw request body before parsing JSON. This is a critical security control to prevent processing forged webhook data. - [SAFE]: The skill promotes secure secret management by instructing the use of environment variables (e.g.,
TERRA_DEV_ID,TERRA_SIGNING_SECRET) rather than hardcoding credentials. - [SAFE]: The skill recommends the use of official vendor tools and documentation, including the Terra CLI (
@tryterra/cli) and the official documentation site (docs.tryterra.co). - [SAFE]: Instructions regarding the fetching of external URLs from
s3_payloadevents are coupled with mandatory cryptographic verification rules, ensuring that data ingestion from external sources is handled securely.
Audit Metadata