The Agent Skills Directory

[SAFE]: The skill correctly implements HMAC-SHA256 signature verification for DocuSign Connect webhooks. It accounts for multiple signature headers (X-DocuSign-Signature-N) to support seamless key rotation.
[SAFE]: Implementation uses best-practice timing-safe comparison functions (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing-based side-channel attacks.
[SAFE]: The code correctly identifies that the signature must be validated against the raw request body before any JSON parsing or re-serialization occurs.
[INDIRECT_PROMPT_INJECTION]: The webhook handlers ingest untrusted data from external HTTP requests. Although the provided examples only log the event types and envelope IDs, this creates an attack surface for indirect prompt injection if the processed data is later used in an LLM context without sanitization.
Ingestion points: POST /webhooks/docusign endpoint in examples/express/src/index.js, examples/nextjs/app/webhooks/docusign/route.ts, and examples/fastapi/main.py.
Boundary markers: None present in the example code.
Capability inventory: The examples are limited to logging to the console.
Sanitization: No sanitization is performed on the event or envelopeId fields before logging.

docusign-webhooks