The Agent Skills Directory

[SAFE]: The skill implements standard webhook authentication patterns using official Paddle SDKs and manual HMAC-SHA256 verification. The provided implementation code for Node.js and Python correctly uses timing-safe equality checks (crypto.timingSafeEqual and hmac.compare_digest) to mitigate timing attacks during signature validation.
[CREDENTIALS_UNSAFE]: No hardcoded API keys or secrets are present. The skill provides .env.example files and explicitly instructs users to store sensitive keys like PADDLE_WEBHOOK_SECRET in environment variables rather than hardcoding them in the source code.
[EXTERNAL_DOWNLOADS]: Dependencies listed in the package manifest files (package.json, requirements.txt) represent standard, legitimate libraries for the respective ecosystems. While some version strings (e.g., TypeScript 6, Next.js 16, FastAPI 0.136) appear to be placeholders or future-dated versions not currently in release, they target official package registries and no evidence of typosquatting or malicious dependency substitution was found.
[COMMAND_EXECUTION]: The documentation references npx hookdeck-cli, which is a legitimate utility provided by the skill's author (Hookdeck) to facilitate local webhook testing. No unauthorized or hidden shell command execution was found within the skill's instructions or implementation files.

paddle-webhooks