The Agent Skills Directory

[SAFE]: The skill implements best practices for webhook security, including the mandatory Microsoft Graph validation handshake and timing-safe verification of the clientState secret using crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python.
[DATA_EXPOSURE]: No hardcoded credentials were found. The skill uses environment variables for sensitive configuration like MICROSOFT_CLIENT_SECRET and MICROSOFT_GRAPH_CLIENT_STATE, providing .env.example files for guidance.
[EXTERNAL_DOWNLOADS]: Dependencies listed in package.json and requirements.txt are official Microsoft libraries (@microsoft/microsoft-graph-client, msgraph-sdk, azure-identity) or well-known industry-standard frameworks (Express, FastAPI, Next.js).
[COMMAND_EXECUTION]: The documentation suggests using the hookdeck-cli for local development. This is a legitimate vendor tool provided by the skill author for tunnel creation and webhook debugging.
[INDIRECT_PROMPT_INJECTION]: While the skill defines handlers for external data (Microsoft Graph notification payloads), the example implementations only perform logging and state validation. There is no evidence of the data being used in unsafe sinks like eval() or being directly interpolated into further AI prompts without sanitization.

microsoft-graph-webhooks