The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process webhooks from external providers, which constitutes an ingestion point for untrusted data.
Ingestion points: Webhook endpoints defined in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/route.ts receive POST requests from external sources.
Boundary markers: The skill mandates HMAC SHA-256 signature verification (x-hookdeck-signature) using a shared secret before the payload is parsed or processed.
Capability inventory: The provided handlers are restricted to logging metadata and returning JSON responses; they do not expose file system access, network egress, or shell execution to the webhook data.
Sanitization: The skill demonstrates parsing the raw body as JSON after verification, ensuring the data format is valid before internal use.
[COMMAND_EXECUTION]: Documentation files recommend using the Hookdeck CLI for local development and testing.
Evidence: The README files in the examples/ directory and SKILL.md suggest running npx hookdeck-cli listen to tunnel webhooks. These are standard developer tools provided by the vendor (Hookdeck) and represent legitimate workflow instructions.
[SAFE]: The skill follows cryptographic best practices by using crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python to prevent timing side-channel attacks during signature verification.

hookdeck-event-gateway-webhooks