The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends using hookdeck-cli via npx for local development and testing. This is a legitimate utility provided by the skill's author (hookdeck) to facilitate webhook tunneling and debugging.
[EXTERNAL_DOWNLOADS]: Several example configuration files (package.json and requirements.txt) specify non-existent future versions for common packages (e.g., next^16.2.10, typescript^6.0.3, vitest^4.1.9, jest^30.4.2, fast-xml-parser^5.9.3, and pytest>=9.1.1). These appear to be versioning hallucinations rather than malicious targeting, though they will cause package installation failures in a live environment.
[SAFE]: The skill correctly implements security measures for unsigned Salesforce Outbound Messages by using crypto.timingSafeEqual (in Node.js) and hmac.compare_digest (in Python) to validate the OrganizationId. This protects against timing attacks during the verification process.
[SAFE]: The skill follows secure data handling practices by advising users to parse the raw request body (request.text() or request.body()) for XML content, ensuring that SOAP envelopes are processed correctly without being corrupted by standard JSON middleware.

salesforce-webhooks