The Agent Skills Directory

[PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection by implementing webhook handlers that ingest external data from Quoter deliveries.
Ingestion points: /webhooks/quoter endpoint in examples/express/src/index.js, examples/nextjs/app/webhooks/quoter/route.ts, and examples/fastapi/main.py.
Boundary markers: The implementation does not include explicit delimiters or instructions for the agent to ignore instructions embedded in the parsed payload.
Capability inventory: The handlers parse the payload and log the object ID; no high-risk capabilities like code execution or file modification are exposed.
Sanitization: The code uses standard JSON parsing but lacks specific sanitization of input data before processing.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends using npx hookdeck-cli for local testing. This utility is a vendor-provided tool from the skill's author to assist developers in managing webhook deliveries.
[SAFE]: The skill implements signature verification using timing-safe comparison methods (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) and validates timestamps against a 300-second window to mitigate replay attacks.

quoter-webhooks