The Agent Skills Directory

[SAFE]: The skill provides robust implementation examples for Express, Next.js, and FastAPI. All templates correctly use the X-Favro-Webhook header and HMAC-SHA1 for signature verification, ensuring that only authenticated payloads from Favro are processed.
[EXTERNAL_DOWNLOADS]: The skill references standard packages and the hookdeck-cli tool for development. While some version numbers in package.json and requirements.txt (e.g., next, typescript, pytest) appear to be placeholders higher than currently released versions, the package names are official and the tool belongs to the skill's author, presenting no immediate security risk beyond standard maintenance requirements.
[PROMPT_INJECTION]: The skill demonstrates how to ingest external data from Favro webhooks. As an indirect prompt injection surface, it is properly mitigated through cryptographic verification. The evidence chain is as follows:
Ingestion points: Webhook payloads are ingested via express.json() in examples/express/src/index.js, request.body() in examples/fastapi/main.py, and request.text() in examples/nextjs/app/webhooks/favro/route.ts.
Boundary markers: Explicit markers are absent, as the skill provides code templates rather than direct agent instructions.
Capability inventory: No dangerous capabilities (such as shell execution, file writing, or network exfiltration) are present in the handler logic.
Sanitization: The skill enforces strict HMAC-SHA1 signature verification using a shared secret before any processing occurs.

favro-webhooks