The Agent Skills Directory

[SAFE]: The skill correctly implements Fireblocks Webhooks v2 signature verification using detached JWS (RS512) signatures validated against official Fireblocks JWKS endpoints (e.g., keys.fireblocks.io).
[SAFE]: Instructions and code examples specifically mandate the use of raw request body bytes for verification, a critical security measure to prevent payload tampering and canonicalization attacks.
[SAFE]: Implementations for Express, Next.js, and FastAPI include proper error handling for signature verification failures, returning 400 Bad Request to the sender as recommended.
[SAFE]: Each example includes a comprehensive test suite (Vitest/Pytest) that verifies behavior against valid, invalid, tampered, and incorrectly signed payloads using local mock keys.
[EXTERNAL_DOWNLOADS]: The documentation includes instructions to use hookdeck-cli via npx for local development. This is a legitimate utility provided by the skill author (hookdeck) for webhook tunneling and is categorized as safe vendor tooling.
[SAFE]: External network operations are restricted to fetching public key sets from Fireblocks' official infrastructure, with support for configurable overrides for advanced testing environments.
[SAFE]: The skill relies on well-established and audited cryptographic libraries such as jose for Node.js and jwcrypto for Python.

fireblocks-webhooks