The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references the hookdeck-cli tool, which is used via npx to facilitate local webhook testing and tunneling. This is a legitimate utility provided by the skill's author.
[DATA_EXPOSURE]: The skill defines endpoints that ingest external data from NMI webhooks. The provided implementation mitigates risks by enforcing signature verification using a shared secret before the application parses or acts upon the untrusted data.
[CREDENTIALS_UNSAFE]: The skill includes environment variable templates (.env.example) and unit tests that use placeholders or dummy keys for the NMI_SIGNING_KEY. It correctly instructs users to manage real secrets through environment variables.
[SAFE]: The code implements timing-safe comparisons (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) when validating signatures, preventing potential timing side-channel attacks.

nmi-webhooks