The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides logic to handle external HubSpot webhook data, which creates a potential ingestion surface for untrusted data. This risk is effectively mitigated by the implementation of X-HubSpot-Signature-v3 (HMAC-SHA256) verification as a mandatory security boundary before any data is processed.
Ingestion points: Webhook POST handlers in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/hubspot/route.ts.
Boundary markers: HMAC-SHA256 signature verification is implemented to authenticate incoming HubSpot requests.
Capability inventory: The example code is limited to logging event metadata (e.g., object IDs) to the console.
Sanitization: Payloads are parsed using standard JSON decoders only after successful signature verification.
[SAFE]: Automated scanner alerts regarding malicious URLs (e.g., 'attacker.example.com') and malicious files are false positives. These elements are located within unit and integration tests (examples/express/test/webhook.test.js, examples/fastapi/test_webhook.py, and examples/nextjs/test/webhook.test.ts) and are used solely to verify that the validation logic correctly rejects requests when the hostname or payload is tampered with.
[SAFE]: The project references futuristic dependency versions (e.g., Next.js 16, TypeScript 6, Pytest 9). While these versions are currently unreleased, they are assessed as placeholders or documentation inconsistencies rather than supply chain attacks, as the code logic follows established security best practices and external references point to legitimate vendor repositories.

hubspot-webhooks