The Agent Skills Directory

[SAFE]: The skill demonstrates secure implementation of Paymob webhook verification using HMAC-SHA512 with concatenated transaction fields.
[SAFE]: Code examples utilize timing-safe comparison functions (crypto.timingSafeEqual and hmac.compare_digest) to mitigate timing side-channel attacks during signature validation.
[SAFE]: Sensitive credentials, specifically the Paymob HMAC secret, are handled via environment variables, following secure configuration practices.
[SAFE]: Example configuration files contain futuristic version numbers for dependencies (e.g., TypeScript 7.0.2, Next.js 16.2.12). While these versions do not currently exist, the package names refer to reputable, well-known libraries and do not represent a security threat in the provided context.
[EXTERNAL_DOWNLOADS]: The skill suggests using hookdeck-cli, a developer tool from the skill's author, for local webhook testing. This tool is executed via npx from the official npm registry.
[DATA_EXFILTRATION]: The skill does not perform any unauthorized network requests or access sensitive local files. Its functionality is focused on processing incoming payment notifications.
[REMOTE_CODE_EXECUTION]: All dependency installations and command-line examples use standard, reputable tools and libraries without any suspicious piping to shell or dynamic execution of remote scripts.

paymob-webhooks