The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The webhook handlers in the provided examples interpolate the x-circle-key-id header directly into an API request URL that includes the CIRCLE_API_KEY in the request headers. An attacker could use path traversal characters (such as ../) in the header to manipulate the request path, potentially calling unintended endpoints on the Circle API using the developer's credentials.
Ingestion points: The x-circle-key-id header processed in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/circle/route.ts.
Boundary markers: No validation or sanitization is performed on the header value before interpolation.
Capability inventory: Performs network GET requests with a sensitive API key.
Sanitization: Absent. The keyId is used directly in string interpolation.
[EXTERNAL_DOWNLOADS]: The configuration files specify package versions that are significantly higher than the current stable releases (e.g., Next.js v16, TypeScript v7, Jest v30, FastAPI v0.139, Pytest v9). While the packages themselves are well-known, specifying non-existent versions is a suspicious practice that could lead to installation failures or dependency confusion risks if such versions were to be maliciously registered in a registry.
Evidence: Found in package.json and requirements.txt files across the example directories.

circle-webhooks