The Agent Skills Directory

[SAFE]: The skill focuses on the 'fetch-to-confirm' pattern, which is the industry-standard security model for Mollie webhooks. It provides clear warnings that webhook request bodies must not be trusted and demonstrates how to verify payment status by querying the official Mollie API using a server-side secret.
[EXTERNAL_DOWNLOADS]: The documentation suggests using hookdeck-cli via npx for local development. This is an official utility provided by the skill's author (hookdeck) for webhook tunneling and does not constitute an unsafe remote download.
[COMMAND_EXECUTION]: The examples include standard instructions for setting up development environments using package managers like npm and pip, as well as running local servers with uvicorn and node.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The webhook handlers ingest an id parameter from application/x-www-form-urlencoded payloads (detected in main.py, src/index.js, and route.ts).
Boundary markers: The skill's architecture implements a functional boundary where all data in the incoming request is ignored except for the ID, which is then used to perform an authenticated out-of-band request to the service provider.
Capability inventory: The code samples utilize network access via httpx or @mollie/api-client to communicate with api.mollie.com.
Sanitization: The id is treated as a literal identifier for API lookups and is not executed or interpreted as a prompt.
[DATA_EXPOSURE]: The skill provides best-practice guidance for handling secrets, instructing users to store the MOLLIE_API_KEY in environment variables rather than hardcoding it.

mollie-webhooks