The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Several dependency manifest files (package.json, requirements.txt) specify versions for popular libraries that have not yet been released. Examples include next@^16.2.11, typescript@^7.0.2, vitest@^4.1.10, jest@^30.4.2, fastapi>=0.139.2, and pytest>=9.1.1. Referencing non-existent versions of common packages is a potential security risk that could be exploited via dependency confusion if a malicious actor registers those version numbers on public registries. Using hallucinated or unreleased versions can lead to the installation of untrusted code from non-official sources.\n- [SAFE]: The skill provides robust implementation patterns for cryptographic signature verification, utilizing timing-safe comparison functions (crypto.timingSafeEqual and hmac.compare_digest) to prevent timing side-channel attacks.\n- [SAFE]: Correct instructions are provided for handling raw request bodies during the verification process, which is critical for maintaining signature integrity in webhook handlers and preventing re-serialization mismatches.\n- [SAFE]: Secret management practices recommended by the skill (using environment variables for the SHOPLINE_APP_SECRET) align with industry security standards and avoid credential exposure.

shopline-webhooks