The Agent Skills Directory

[SAFE]: The skill correctly implements Shopify webhook signature verification using HMAC-SHA256 with crypto.timingSafeEqual, which effectively prevents timing attacks during authentication.
[SAFE]: Idempotency logic is properly designed using the X-Shopify-Webhook-Id header and a database check, ensuring that duplicate event deliveries do not cause side effects.
[SAFE]: The Express middleware implementation uses express.raw to preserve the original request body for signature validation, adhering to Shopify's technical requirements and avoiding signature corruption.
[SAFE]: All external dependencies are standard industry-recognized packages (Express, BullMQ) used for their intended purposes without suspicious configuration or behavior.

shopify-webhooks