The Agent Skills Directory

[SAFE]: The skill provides comprehensive and secure examples for receiving and verifying MailerSend webhooks across multiple frameworks (Express, Next.js, FastAPI).
[SAFE]: Signature verification correctly implements HMAC-SHA256 over the raw request body. The examples use crypto.timingSafeEqual (Node.js) and hmac.compare_digest (Python) to prevent timing attacks, including proper length guards to prevent execution errors on malformed input.
[SAFE]: The skill correctly identifies and handles the webhook.test ping, which uses a publicly documented fixed secret (test_Am3L1GuOIc4blLUuHqAPxxwkZaJyEk8G). The implementation ensures this public secret is only accepted for the test ping and cannot be used to forge real activity events.
[SAFE]: Instructions for secret management are correct, advising users to store their signing secrets in environment variables and explicitly warning against exposing them to the client side in Next.js.
[SAFE]: The examples include idempotency checks using the data.id field to prevent duplicate processing, which is a recommended practice for webhook handling.
[SAFE]: Dependency management uses standard package registries and well-known libraries (dotenv, express, fastapi, uvicorn, vitest, pytest) without any suspicious or unversioned packages.

mailersend-webhooks