The Agent Skills Directory

[SAFE]: The skill implements robust security for webhook handling. It uses industry-standard HMAC-SHA256 verification and timing-safe comparison functions to validate requests. The code correctly handles the raw request body to ensure that the signature verification is accurate and not affected by JSON parsing variations.
[PROMPT_INJECTION]: The skill provides templates for processing external data via webhooks, which constitutes an indirect prompt injection surface.
Ingestion points: POST /webhooks/klaviyo handlers in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/klaviyo/route.ts.
Boundary markers: The code requires valid Klaviyo-Signature and Klaviyo-Timestamp headers verified against a shared secret.
Capability inventory: The example event handlers perform non-sensitive operations such as logging to the console. No high-risk capabilities like arbitrary command execution or file system access are provided.
Sanitization: Webhook data is cryptographically authenticated prior to parsing.

klaviyo-webhooks