The Agent Skills Directory

[SAFE]: The skill implements robust signature verification using HMAC-SHA256 with the v1 scheme, ensuring payload integrity by signing the raw request body alongside a timestamp.
[SAFE]: Cryptographic comparisons are performed using timing-safe functions (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent potential timing attacks.
[SAFE]: Sensitive configuration, such as the webhook signing secret, is managed through environment variables (.env files), which aligns with security best practices for credential management.
[SAFE]: The use of external tools like hookdeck-cli for local development is documented as a standard vendor-provided utility for webhook testing.
[SAFE]: The skill includes clear documentation regarding the deprecation of insecure older signature schemes (v0), guiding users toward the more secure v1 implementation.

faundit-webhooks