The Agent Skills Directory

[SAFE]: The skill provides robust implementations for Nylas webhook signature verification. It correctly uses HMAC-SHA256 with the webhook_secret and employs constant-time comparison methods (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing attacks.
[SAFE]: The handlers are designed to verify the raw request body before JSON parsing, including proper handling of gzipped payloads. This 'verify-before-parse' approach is a critical security pattern for preventing processing-level attacks on unauthenticated data.
[EXTERNAL_DOWNLOADS]: The provided examples include standard dependencies from official registries, such as express, fastapi, and the nylas SDK. It also references the hookdeck-cli for local development, which is maintained by the skill's author.
[COMMAND_EXECUTION]: Setup instructions include standard environment preparation commands (e.g., npm install, pip install) and instructions for using the author's CLI tool to tunnel webhooks for local testing.

nylas-webhooks