openfactura-webhooks
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by instructing users to store sensitive webhook secrets in environment variables (e.g.,
OPENFACTURA_WEBHOOK_SECRET) rather than hardcoding them or committing them to version control. - [SAFE]: The provided code implementation includes a signature verification routine using HMAC-SHA256 via the WebCrypto API. This ensures the integrity and authenticity of the data received by the user's endpoint.
- [SAFE]: The skill enforces secure connectivity by requiring HTTPS and publicly accessible domains for webhook endpoints, preventing common misconfigurations involving local or private IP addresses.
- [SAFE]: External references point to official documentation at
docs.openfactura.co, which is the legitimate domain for the service vendor.
Audit Metadata