The Agent Skills Directory

[SAFE]: The skill implements secure webhook handling practices.
Verified that HMAC-SHA256 signature verification is performed on the raw request body before any data processing, ensuring authenticity.
Verified the use of timing-safe comparison functions (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing attacks during signature validation.
[CREDENTIALS_UNSAFE]: No credential exposure detected.
The skill instructs users to store the Ashby secret in .env files and accesses it via environment variables, which is a standard security practice.
No hardcoded secrets or sensitive keys were found in the provided code or configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill effectively mitigates potential injection risks from external data sources.
Ingestion points: Untrusted webhook payloads enter the system through the /webhooks/ashby POST endpoint across all provided examples.
Boundary markers: Robust cryptographic verification ensures that only requests authentically signed by Ashby are processed by the application logic.
Capability inventory: The provided handlers perform logging and basic dispatch logic; no dangerous capabilities (like shell execution or arbitrary file writes) are exposed to the processed content.
Sanitization: While the internal data object is parsed from JSON, the signature verification provides a primary trust boundary that prevents unauthorized input processing.
[EXTERNAL_DOWNLOADS]: All referenced dependencies are standard, official libraries from public registries (NPM and PyPI). References to hookdeck-cli relate to the author's own utility for local development.

ashby-webhooks