The Agent Skills Directory

[SAFE]: The skill implements robust security practices for processing webhooks, specifically using HMAC-SHA256 signature verification over the raw request body and employing timing-safe comparison functions to mitigate timing attacks.
[CREDENTIALS_UNSAFE]: The skill follows established best practices for secret management by providing .env.example templates and directing users to store sensitive signing keys in environment files rather than hardcoding them. No active credentials were detected in the source code.
[EXTERNAL_DOWNLOADS]: The example projects utilize standard, well-known libraries for Node.js and Python development. While some version numbers in the dependency files (e.g., TypeScript 7.0.2, Next.js 16.2.11, Jest 30.4.2) exceed current stable releases, the package names are legitimate, and the use of inflated versions appears to be a templating artifact rather than a malicious attempt at dependency confusion.
[COMMAND_EXECUTION]: The instructions involve standard development commands such as package installation (npm, pip) and running development servers. The inclusion of npx hookdeck-cli is a verified resource provided by the skill author for local tunneling.
[INDIRECT_PROMPT_INJECTION]: The skill exposes endpoints to ingest external data, which is correctly identified as a potential attack surface.
Ingestion points: Publicly accessible POST endpoints defined in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/alchemy/route.ts.
Boundary markers: The handler logic strictly enforces signature verification as a security boundary before any data parsing or processing occurs.
Capability inventory: The skill only performs logging of specific event metadata (network, asset, address, transaction hash) to the console.
Sanitization: Mandatory signature verification using the per-webhook signing key serves as the primary sanitization mechanism to ensure the integrity and authenticity of the ingested data.

alchemy-webhooks