The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines handlers for external webhooks, which constitutes an ingestion point for untrusted data. However, it incorporates robust security controls to mitigate risks.
Ingestion points: Webhook endpoints in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/clerk/route.ts.
Boundary markers: The skill strictly enforces HMAC-SHA256 signature verification using svix headers and validates the svix-timestamp to prevent replay attacks.
Capability inventory: Handlers are designed to process user and session lifecycle events, typically involving database synchronization and application state updates.
Sanitization: Input is parsed as JSON only after the integrity and authenticity of the payload have been cryptographically verified.
[EXTERNAL_DOWNLOADS]: The documentation and examples suggest using the author's CLI tool for local development.
Evidence: SKILL.md and example READMEs recommend running npx hookdeck-cli listen to tunnel webhooks to the local environment.
Context: This is a standard development practice for the vendor's ecosystem.

clerk-webhooks