The Agent Skills Directory

[SAFE]: The skill implements security best practices for credential verification by using timing-safe string comparisons (‘crypto.timingSafeEqual’ in Node.js and ‘hmac.compare_digest’ in Python) to prevent timing attacks against optional HTTP Basic Auth credentials.
[SAFE]: Infrastructure-level security is correctly prioritized; the documentation identifies mutual TLS (mTLS/MSSL) as the definitive authentication mechanism for the Ethoca Alerts Push API, aligning with established financial industry standards.
[SAFE]: External resource references and dependencies, including the ‘hookdeck-cli’ and ‘mastercard-oauth1-signer’ library, originate from the verified author or well-known, trusted technology providers.
[SAFE]: Webhook data ingestion is handled via standard JSON parsing without exposing the system to risks such as command injection, privilege escalation, or unauthorized file access.
[SAFE]: The skill includes comprehensive error handling and test suites that validate security logic, including tests for unauthorized access when credentials are configured.

ethoca-webhooks