What problem does it solve? Webhook integrations often accept replayed, expired, or unsigned events because signature verification is incomplete. This Skill provides an evidence-gated workflow to verify whether your own webhook sender and receiver correctly enforce signature algorithms, canonicalization, timestamp windows, and nonce uniqueness. ## Core Features & Use Cases - Signature Coverage Verification: Confirms which fields the signature actually covers and detects canonicalization or encoding-order weaknesses. - Replay and Timestamp Testing: Compares receiver behavior for normal events versus expired timestamps, duplicate event IDs, and repeated nonces using pre-registered no-op events. - Oracle-Based Verdicts: Only counts a finding when the receiver accepts an event it should reject and server audit logs confirm actual processing, eliminating false positives from HTTP 2xx acknowledgments. - Use Case: Before launching a payment callback integration, use this Skill to confirm your receiver rejects replayed and stale signed events, then route any callback URL concerns to SSRF or open-redirect review. ## Quick Start Use the hunt-webhook-signature skill to plan an authorized validation of my webhook receiver's signature and replay defenses.
