The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The example configuration files (package.json and requirements.txt) include version constraints for several well-known packages (e.g., next, typescript, fastapi, and vitest) that specify version numbers exceeding the currently available stable releases. While these appear to be artifacts of the content generation process rather than malicious intent, using non-existent or unpinned future versions in templates is a minor best-practice violation as it could theoretically be exploited for dependency confusion attacks.
[COMMAND_EXECUTION]: The skill's instructions recommend using the hookdeck-cli via npx for tunneling webhooks to a local development environment. This is a legitimate utility provided by the skill's author ('hookdeck') and is standard practice for developing and testing webhook handlers.
[DATA_EXFILTRATION]: As its primary function is to serve as a webhook handler, the skill is designed to receive and process data from external Meta APIs. The provided implementations adhere to security best practices by performing timing-safe HMAC SHA-256 signature verification on the raw request body before any data parsing or processing occurs.
Ingestion points: Webhook payloads are received at the POST /webhooks/facebook routes defined in the Next.js, Express, and FastAPI implementations.
Boundary markers: The skill explicitly instructs users to verify the X-Hub-Signature-256 header to ensure the authenticity and integrity of the incoming data before processing.
Capability inventory: The example code is limited to logging event details to the console; no high-risk capabilities such as arbitrary code execution, subprocess spawning, or unauthorized file system access are present.
Sanitization: Payload verification is performed using standard cryptographic methods and timing-safe comparisons (e.g., crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing attacks.

facebook-webhooks