The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads public RSA certificates from paypal.com or its subdomains to verify webhook signatures. The implementation includes strict hostname validation to ensure certificates are only fetched from trusted PayPal infrastructure. Evidence: examples/fastapi/main.py (fetch_cert), examples/express/src/index.js (fetchCert), examples/nextjs/app/webhooks/paypal/route.ts (fetchCert).
[COMMAND_EXECUTION]: The documentation and setup scripts include standard commands for project initialization and local development, such as npm install, pip install, uvicorn main:app, and npx hookdeck-cli listen.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted webhook data from external sources. It implements security best practices by verifying signatures using raw request bytes before parsing payloads, and it validates the certificate source to mitigate spoofing risks. Evidence: examples/fastapi/main.py (paypal_webhook), examples/express/src/index.js (app.post), examples/nextjs/app/webhooks/paypal/route.ts (POST).
[SAFE]: Automated scans detected attacker.example.com URLs as phishing risks. Analysis confirms these URLs are used exclusively within negative test cases to verify that the application correctly rejects untrusted certificate providers. Evidence: examples/fastapi/test_webhook.py, examples/express/test/webhook.test.js, examples/nextjs/test/webhook.test.ts.

paypal-webhooks