The Agent Skills Directory

[SAFE]: The skill demonstrates robust security patterns for webhook verification.
It uses timing-safe comparisons via crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python to prevent timing attacks.
It correctly mandates the use of the raw request body for signature calculation to maintain payload integrity.
It implements replay attack protection by validating the t (timestamp) parameter against a 180-second tolerance window.- [EXTERNAL_DOWNLOADS]: Fetches the hookdeck-cli utility via npx for local development. This is a well-known service provided by the skill author for webhook debugging and is a standard development tool.- [CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets were detected. The skill uses environment variable placeholders and provides clear documentation on secure secret management using .env files.

calendly-webhooks