The Agent Skills Directory

[SAFE]: The skill provides comprehensive instructions for verifying GoCardless webhook signatures using the official SDK (Node.js) or manual HMAC-SHA256 implementation (Python). This ensures that only authenticated requests from GoCardless are processed.
[EXTERNAL_DOWNLOADS]: The skill suggests using hookdeck-cli via npx for local testing. This utility is provided by the skill's author (hookdeck) to tunnel webhooks to a local development environment. These references are documented neutrally as standard developer tooling.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage the GOCARDLESS_WEBHOOK_SECRET via environment variables and includes .env.example files to prevent accidental credential leakage in version control. Test files include official GoCardless public test vectors, which are not sensitive production secrets.
[INDIRECT_PROMPT_INJECTION]: The skill defines a webhook ingestion surface but implements proper security boundaries.
Ingestion points: Public POST endpoints at /webhooks/gocardless in Express, Next.js, and FastAPI examples.
Boundary markers: Mandatory HMAC-SHA256 signature verification is performed on the raw request body before any data processing occurs.
Capability inventory: The provided examples are limited to logging event data to the console; they do not perform file writes, database operations, or shell command executions based on the webhook payload.
Sanitization: Verification of the Webhook-Signature header acts as the primary integrity and authenticity check for all incoming data.

gocardless-webhooks