The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a surface for ingesting untrusted external data via HTTP POST webhook endpoints.
Ingestion points: The templates define endpoints at /webhooks/resend which receive JSON payloads from Resend.
Boundary markers: The skill provides comprehensive instructions and code for Svix signature verification, which ensures the payload integrity and authenticity before processing.
Capability inventory: The provided code snippets demonstrate basic logging and database update placeholders (TODO sections). No dangerous subprocesses or arbitrary execution are implemented.
Sanitization: All templates use HMAC-SHA256 signature verification (manual or via SDK) and implement timestamp tolerance (5 minutes) to mitigate replay attacks. Timing-safe equality checks (crypto.timingSafeEqual and hmac.compare_digest) are correctly used.
[DATA_EXPOSURE_AND_EXFILTRATION]: No hardcoded credentials or sensitive file paths were detected.
Evidence: .env.example files correctly use placeholders like re_your_api_key_here and whsec_your_webhook_secret_here. Test suites use dummy keys (e.g., whsec_dGVzdF9zZWNyZXRfa2V5X2Zvcl90ZXN0aW5n) which decode to benign test strings.
[EXTERNAL_DOWNLOADS]: The documentation references hookdeck-cli for local testing. This is a legitimate tool provided by the skill author (Hookdeck) for webhook development and is documented neutrally as a recommended tool.

resend-webhooks