The Agent Skills Directory

[SAFE]: The skill implements robust security practices for webhook handling:
Signature Verification: All implementation examples (Next.js, Express, FastAPI) correctly verify the X-Front-Signature header using HMAC-SHA256 with a user-provided secret.
Raw Body Processing: The skill correctly instructs and demonstrates using the raw request body for verification to prevent signature mismatches caused by JSON re-serialization.
Timing-Safe Comparison: Uses crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python to prevent timing attacks during signature validation.
Challenge Handshake: Correctly handles the X-Front-Challenge subscription validation before processing events.
[SAFE]: External dependencies and tools are standard for the respective frameworks or provided by the vendor (e.g., hookdeck-cli for local tunneling), which is appropriate for the skill's stated purpose.

frontapp-webhooks