The Agent Skills Directory

[SAFE]: The skill implements a 'secure-by-construction' approach, providing explicit instructions to avoid handling raw card data on servers and recommending client-side encryption via SDKs to reduce PCI-DSS scope.
[SAFE]: It includes comprehensive guidance on verifying webhook authenticity using SHA256 hashes and constant-time comparisons, mitigating potential spoofing and timing attacks.
[SAFE]: The documentation mandates a 'zero-trust' protocol for asynchronous notifications, instructing the agent to fetch the canonical resource state via authenticated API calls before updating internal records.
[SAFE]: It provides detailed procedures for managing sensitive assets like mTLS certificates, OAuth tokens, and RSA keys, emphasizing the use of secrets managers and atomic updates.
[SAFE]: Environment isolation is strictly enforced, with clear separation between sandbox and production credentials, endpoints, and data stores.
[SAFE]: All included code snippets and request patterns prioritize security features such as Idempotency-Key headers, redaction of PII in logs, and secure base URL handling.

pagbank