The Agent Skills Directory

[SAFE]: The skill implements robust signature verification using HMAC-SHA256 with timing-safe comparison (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python), which is the standard for preventing timing-based attacks on cryptographic validations.
[SAFE]: Instructions correctly emphasize using the raw request body for verification to prevent authentication failures that can be caused by JSON re-serialization differences in whitespace or key ordering.
[SAFE]: Promotes secure secret management by utilizing environment variables for the webhook signing secret (wbhsec_...) and provides configuration templates rather than hardcoding sensitive credentials.
[SAFE]: The included reference to hookdeck-cli for local development originates from the vendor (Hookdeck) and is used for standard development tasks such as tunneling webhooks to localhost.

persona-webhooks