The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing users to manage sensitive credentials like BIGCOMMERCE_CLIENT_SECRET via environment variables. It provides .env.example files with clear placeholders and explicitly warns against committing secrets to version control.
[COMMAND_EXECUTION]: Includes standard commands for setup and local development, such as npm install, npx hookdeck-cli, and curl requests to the official BigCommerce API (api.bigcommerce.com). These are benign and necessary for the skill's stated purpose.
[SAFE]: Implements robust security for incoming data by using the standardwebhooks library to verify HMAC-SHA256 signatures. This ensures the integrity and authenticity of webhooks before they are processed by the application.
[SAFE]: All external references and dependencies target well-known services (BigCommerce, GitHub) or the vendor's own official tools (hookdeck-cli), representing legitimate functionality with no signs of malicious behavior.

bigcommerce-webhooks