The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external webhook data from Quo (formerly OpenPhone), creating an attack surface for indirect prompt injection if the processed data is later used in LLM prompts without sanitization.
Ingestion points: Webhook endpoints defined in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/quo/route.ts.
Boundary markers: The skill implements robust HMAC-SHA256 signature verification (Scheme A and Scheme B) which ensures data authenticity before processing.
Capability inventory: The provided handlers log event data to the console; no high-privilege operations or dynamic execution patterns are present in the provided code.
Sanitization: Verification occurs on the raw request bytes before JSON parsing; however, the skill does not implement secondary sanitization of the extracted fields before logging.
[EXTERNAL_DOWNLOADS]: The documentation suggests using hookdeck-cli via npx for local development and testing. This is a tool provided by the skill's author (hookdeck) for webhook inspection.

quo-webhooks