The Agent Skills Directory

[SAFE]: The skill provides secure implementation patterns for webhook verification.
It includes mandatory signature verification before processing payloads.
It implements replay protection by checking the timestamp within a 48-hour window.
It uses constant-time comparison functions (timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing attacks.
It correctly distinguishes between the HMAC-based timestamped scheme and the plain hash-based legacy scheme, providing clear documentation on common implementation pitfalls.
Secret management is handled via environment variables as per best practices, avoiding hardcoded credentials.
External tool usage (hookdeck-cli) is appropriate for the skill's context and corresponds to the skill's author.

recharge-webhooks