The Agent Skills Directory

[SAFE]: The skill promotes security best practices by mandating the use of verifyWebhook to cryptographically validate the authenticity of incoming webhook events from Clerk.
[SAFE]: Secrets such as CLERK_WEBHOOK_SIGNING_SECRET and RESEND_API_KEY are handled exclusively via environment variables, preventing credential exposure in source code.
[SAFE]: Network operations are directed to well-known and trusted services, including Slack and Resend, for legitimate notification and email functionality.
[INDIRECT_PROMPT_INJECTION]: The skill handles data originating from external Clerk events (e.g., user profiles). While the source is verified via signature, the data content is user-controllable.
Ingestion points: Webhook request body processed by verifyWebhook(req) in SKILL.md and references/frameworks.md.
Boundary markers: Mandatory cryptographic signature verification ensures data originates from the trusted provider.
Capability inventory: Database writes via Prisma and network requests via Resend and Slack APIs.
Sanitization: Extracted fields are used within structured templates and database queries rather than being executed as instructions.

clerk-webhooks