The Agent Skills Directory

[SAFE]: The skill provides secure implementation patterns for Snipcart webhook validation, a provider that does not sign payloads and instead requires an authenticated callback verification.
[SAFE]: Implements strict input validation on the X-Snipcart-RequestToken header using a regular expression (/^[A-Za-z0-9_-]{1,128}$/) to mitigate potential path traversal or SSRF-like risks when the token is interpolated into verification URLs.
[SAFE]: Uses security-conscious HTTP client configurations, specifically setting redirect: 'manual' (in Node.js) and follow_redirects=False (in Python), to prevent the accidental leakage of the store's secret API key through HTTP redirects.
[SAFE]: Demonstrates a "fail-closed" security posture, ensuring that requests are rejected if the validation API call encounters network errors, timeouts, or unauthorized status codes.
[SAFE]: Provides clear guidance on secret management, advocating for the use of environment variables and warning against exposing secret API keys to client-side code.
[SAFE]: The suggested use of npx hookdeck-cli for local development is an industry-standard practice for the vendor and involves well-known developer tools.

snipcart-webhooks