The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches JSON Web Key Sets (JWKS) from Microsoft's official identity service (login.microsoftonline.com) to dynamically retrieve public keys for validating Microsoft Entra ID bearer tokens. This is a standard and secure practice for verifying identity in Microsoft-protected environments.
[COMMAND_EXECUTION]: The documentation provides instructions for using the hookdeck-cli to facilitate local development and tunnel creation. This is an expected utility for testing webhook handlers and originates from the skill's authoring organization.
[INDIRECT_PROMPT_INJECTION]: As a webhook handler, the skill inherently possesses a surface for ingesting untrusted data from external HTTP requests. However, the implementation mitigates this risk by providing clear instructions and code for performing strict authentication checks (checking aeg-subscription-name and verifying channel credentials) before any business logic is executed or data is processed.
[CREDENTIALS_UNSAFE]: The skill correctly manages sensitive data by using environment variable placeholders in .env.example files and provides guidance on rotating secrets using comma-separated lists to prevent delivery downtime.

azure-event-grid-webhooks