The Agent Skills Directory

[PROMPT_INJECTION]: No malicious instruction overrides or bypass attempts were detected in the skill instructions or metadata.
[CREDENTIALS_UNSAFE]: The skill correctly avoids hardcoding secrets, using environment variable placeholders like BUNNY_STREAM_WEBHOOK_SECRET. Documentation follows security best practices by recommending .env files for local development.
[DATA_EXFILTRATION]: No unauthorized data access or transmission to suspicious third-party domains was found. All external references are directed toward legitimate documentation (Bunny.net) or the vendor's own tools (Hookdeck).
[COMMAND_EXECUTION]: Shell commands provided in the README files are restricted to standard development tasks such as installing dependencies and running local servers.
[REMOTE_CODE_EXECUTION]: The skill utilizes well-known, standard libraries for its example implementations (Express, FastAPI, Next.js). The use of the hookdeck-cli is appropriate as it is a tool provided by the skill's author for development purposes.
[SAFE]: The cryptographic implementations for signature verification correctly utilize timing-safe comparisons (crypto.timingSafeEqual and hmac.compare_digest), which is a critical security practice for protecting against timing attacks on webhook handlers.

bunny-stream-webhooks