The Agent Skills Directory

[SAFE]: The skill provides robust boilerplate for HMAC-SHA256 verification of Formstack webhooks, ensuring data integrity and authenticity.
[SAFE]: The implementation follows security best practices by capturing the raw request body bytes for signature calculation, which prevents common failures caused by re-encoding payloads.
[SAFE]: The code utilizes constant-time comparison functions (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to mitigate timing-based side-channel attacks.
[SAFE]: The handlers are designed to 'fail closed,' rejecting any requests if the HMAC key is unconfigured or the signature header is missing, preventing unauthorized access.
[INDIRECT_PROMPT_INJECTION]: The skill defines clear ingestion points for external webhook data. The provided examples handle this data safely by logging or dispatching to local functions, and do not interpolate untrusted input into prompts or dynamic execution contexts.

formstack-webhooks