The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user and agent to install the Hookdeck CLI via Homebrew or NPM (npm install -g hookdeck-cli). It also recommends installing supplementary provider-specific skills from the hookdeck/webhook-skills repository using the npx skills add command. These resources originate from the primary vendor (Hookdeck) or well-known trusted organizations (Vercel Labs).
[COMMAND_EXECUTION]: The skill relies heavily on shell commands for resource management, local development (hookdeck listen), and project configuration. These commands are standard for CLI-based tools and are used to interact with the vendor's platform.
[INDIRECT_PROMPT_INJECTION]: As a skill designed to process webhooks from various third-party providers (Stripe, Shopify, etc.), it naturally handles untrusted external data. The skill mitigates this risk by providing canonical implementations for HMAC signature verification in several frameworks (Express, Next.js, FastAPI) and strongly recommending the use of official provider SDKs for event construction.
[CREDENTIALS_UNSAFE]: The documentation and example files refer to HOOKDECK_API_KEY and HOOKDECK_WEBHOOK_SECRET. However, the skill follows secure development practices by using environment variable placeholders and .env.example files, rather than hardcoding sensitive credentials.

event-gateway