The Agent Skills Directory

[SAFE]: The skill correctly implements HMAC-SHA256 signature verification across all provided framework examples (Express, Next.js, and FastAPI). It emphasizes the critical step of using the raw, unmodified request body for verification to prevent signature mismatches and potential tampering.
[SAFE]: Secret management guidance follows industry best practices by instructing users to store the Airwallex webhook secret in environment variables via .env files, avoiding hardcoded credentials in the source code.
[SAFE]: Use of the vendor-provided hookdeck-cli tool is appropriately documented for local development and testing purposes. This tool is intended to facilitate the inspection and replaying of webhook events during the development cycle and originates from the skill's author.
[SAFE]: Replay protection is implemented in all examples by validating the x-timestamp header against a 5-minute tolerance window, mitigating the risk of replay attacks.

airwallex-webhooks