The Agent Skills Directory

[SAFE]: The skill implements robust authentication by requiring HMAC-SHA256 signature verification using the sanity-webhook-signature header before processing any webhook data.
[COMMAND_EXECUTION]: The skill documentation includes instructions for using npx hookdeck-cli, a developer tool for local webhook tunneling. This execution is scoped to the author's own utility for development purposes.
[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch the hookdeck-cli package and lists standard dependencies such as @sanity/webhook, fastapi, and express from official registries.
[PROMPT_INJECTION]: The skill describes an architecture that handles external data via webhook endpoints, creating an indirect prompt injection surface. This is mitigated through explicit security controls documented in the skill.
Ingestion points: POST /webhooks/sanity endpoints in the Next.js, Express, and FastAPI examples.
Boundary markers: Mandatory HMAC-SHA256 signature verification is performed using a secret shared between Sanity and the handler.
Capability inventory: The examples are restricted to logging document IDs and types; no dangerous capabilities like shell command execution or direct database writes are present in the provided scripts.
Sanitization: Signature verification is performed on the raw request body before any JSON parsing or field access occurs.

sanity-webhooks