The Agent Skills Directory

[SAFE]: The skill provides comprehensive examples for receiving and verifying GitLab webhooks. It correctly implements the recommended signing token verification using HMAC-SHA256 over the raw request body.
[SAFE]: The implementation includes a 5-minute timestamp tolerance window for the webhook-timestamp header, which is a standard security measure to prevent replay attacks.
[SAFE]: Verification functions for both signatures and legacy tokens use timing-safe comparison methods (crypto.timingSafeEqual in Node.js and secrets.compare_digest in Python) to mitigate timing attacks.
[SAFE]: All dependencies identified in package.json and requirements.txt are standard, well-known libraries for the respective frameworks (Express, FastAPI, Next.js) and testing (Jest, Pytest, Vitest).
[SAFE]: The skill uses vendor-owned tools (Hookdeck CLI) for local development, which is consistent with the author's identity and stated purpose.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a robust attack surface for processing external data by design. However, it mitigates risk through several layers of security.
Ingestion points: Webhook endpoints in main.py, route.ts, and src/index.js receive raw HTTP request bodies.
Boundary markers: Strict authentication via HMAC-SHA256 signatures and timestamp verification is required before any data processing occurs.
Capability inventory: The provided handlers are limited to logging event metadata and returning status responses; they do not perform file writes, command execution, or network requests based on the untrusted payload.
Sanitization: Payloads are validated using JSON parsing and, in the FastAPI example, Pydantic models.

gitlab-webhooks