The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements handlers for Shopify webhooks, which are external data ingestion points.
Ingestion points: Webhook endpoints are defined in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/shopify/route.ts.
Boundary markers: The skill mandates and provides code for HMAC-SHA256 signature verification using the X-Shopify-Hmac-SHA256 header, which acts as a strong trust boundary.
Capability inventory: The provided handlers primarily perform logging and contain placeholders for business logic; no dangerous capabilities like arbitrary command execution or unauthorized file access are present.
Sanitization: Payloads are only parsed as JSON after the cryptographic signature has been verified.
[EXTERNAL_DOWNLOADS]: The README files recommend using the Hookdeck CLI tool via npx for local testing and tunneling. This tool is provided by the skill author and is standard for webhook development workflows.
[SAFE]: The signature verification implementation correctly utilizes timing-safe comparison functions—crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python—to protect against timing-based side-channel attacks.

shopify-webhooks