Is webhook-subscriptions safe to install?

SaferSkills independently audited webhook-subscriptions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/devops/webhook-subscriptions/SKILL.md · 1 file

skills/devops/webhook-subscriptions/SKILL.md1.2 KB · Markdown

name: webhook-subscriptions

description: Use when external services should trigger agent runs through webhook events

Webhook Subscriptions

Overview

Webhook-triggered agents are powerful because they turn external events into work. Treat every webhook as an untrusted public input unless proven otherwise.

Setup Pattern

Confirm the gateway or webhook receiver is available.
Generate a strong per-subscription secret outside the repo.
Subscribe to the smallest event set that solves the task.
Test with a synthetic payload.
Log only event metadata, not secret headers or private payload fields.

Example Shape

hermes webhook subscribe repo-issues \
  --events "issues" \
  --prompt "Triage this issue event and propose next steps." \
  --skills "github-issues,github-code-review"

Verification

hermes webhook list
hermes webhook test repo-issues --payload '{"action":"opened"}'

Safety

Require HMAC validation or an equivalent signature check.
Keep webhook secrets in environment variables or a private config file.
Do not commit event payloads from production systems.
Prefer dry-run delivery until the prompt is proven safe.

webhook-subscriptions— agent skill

Is webhook-subscriptions safe to install?

Webhook Subscriptions

Overview

Setup Pattern

Example Shape

Verification

Safety

Audit the pieces. Scan the whole. Decide.