The Agent Skills Directory

[SAFE]: The skill correctly implements HMAC-SHA256 signature verification of incoming JSON payloads using the raw request body. It utilizes constant-time comparison methods (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing side-channel attacks.
[EXTERNAL_DOWNLOADS]: The documentation and examples suggest using the hookdeck-cli via npx for local development. This utility is a vendor-provided tool (by Hookdeck) used for its intended purpose of tunneling webhooks to a local server for testing.
[SAFE]: Secret management instructions correctly advise users to store webhook secrets and API keys in environment variables via .env files, avoiding hardcoded credentials.
[SAFE]: The skill provides defensive-in-depth measures, including instructions and code for verifying optional HTTP Basic Auth and referencing Recurly's IP allowlist.

recurly-webhooks