The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external Bitbucket webhook payloads. However, it implements a robust security boundary by requiring HMAC-SHA256 signature verification before processing any data.
Ingestion points: POST /webhooks/bitbucket endpoints defined in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/bitbucket/route.ts.
Boundary markers: Mandatory verification of the X-Hub-Signature header using a shared secret.
Capability inventory: The provided handlers are limited to logging event metadata and payload summaries to the console; no dangerous operations like shell execution or file system writes are performed.
Sanitization: Webhook bodies are parsed as JSON only after successful cryptographic verification.
[EXTERNAL_DOWNLOADS]: The documentation suggests using the hookdeck-cli (an official tool from the skill's author) for local development and testing.
[SAFE]: Example configuration files (.env.example) use generic placeholders for secrets, and test files use explicitly defined test constants. No real credentials or sensitive information were detected.

bitbucket-webhooks