The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references the official coinbase-commerce-node SDK and standard web frameworks (Express, Next.js, FastAPI). These are reputable, well-known packages from official registries (NPM, PyPI).
[DATA_EXFILTRATION]: No sensitive data exposure or exfiltration patterns were detected. The skill follows best practices by instructing users to store the Coinbase Commerce shared secret in environment variables rather than hardcoding them.
[PROMPT_INJECTION]: The instructions are focused on implementation guidance and do not contain patterns designed to override agent behavior or bypass safety filters.
[REMOTE_CODE_EXECUTION]: No instances of dynamic code execution or unverified remote script execution were found. All code provided in the examples is static and follows standard framework patterns.
[COMMAND_EXECUTION]: The skill uses standard development commands (npm install, pip install, uvicorn) for setup and testing. It also suggests using the hookdeck-cli for local webhook tunneling, which is a routine practice for webhook development.
[DATA_INGESTION]: As a webhook handler skill, it naturally processes external data. The instructions and examples proactively mitigate indirect prompt injection risks by implementing mandatory HMAC-SHA256 signature verification before any data is processed or parsed.

coinbase-commerce-webhooks