The Agent Skills Directory

[SAFE]: The skill implements best-practice security measures for handling ShipStation V1 webhooks, which do not provide cryptographic signatures.
Timing-Safe Comparison: Both Node.js and Python examples use timing-safe comparison functions (crypto.timingSafeEqual and hmac.compare_digest) to verify the secret token provided in the query string, preventing timing attacks.
SSRF Protection: The fetchResource functions include an SSRF guard that validates the resource_url hostname against a strict regular expression (/^ssapi\d*\.shipstation\.com$/), ensuring that the agent only performs authenticated requests to official ShipStation domains.
Credential Management: The skill follows standard security practices by using environment variables for sensitive API keys and secrets, providing .env.example files with placeholders.

shipstation-webhooks