The Agent Skills Directory

[SAFE]: The skill is strictly educational, providing best practices for webhook security. It includes instructions on signature verification to ensure data authenticity and idempotency to prevent race conditions or double-processing vulnerabilities.
[PROMPT_INJECTION]: No prompt injection attempts, role-play instructions, or safety bypass patterns were detected in the instructions or metadata.
[CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets were found. The skill correctly references environment variables (process.env.STRIPE_WEBHOOK_SECRET) for secret management, which is a recommended practice.
[REMOTE_CODE_EXECUTION]: The skill does not perform any external downloads, package installations, or remote script executions.
[DATA_EXFILTRATION]: There are no suspicious network operations or file system access patterns that would indicate data exfiltration or unauthorized exposure of sensitive local files.
[INDIRECT_PROMPT_INJECTION]: While the skill describes handlers for external webhook data, it mandates signature verification (stripe.webhooks.constructEvent) as a boundary marker to ensure the integrity and origin of the data before processing, effectively mitigating injection risks from untrusted sources.

webhook-safety