The Agent Skills Directory

[SAFE]: The skill provides legitimate boilerplate code and documentation for SparkPost webhook integration across multiple frameworks (Express, Next.js, and FastAPI). The implementation is defensive and follows documented provider patterns.\n- [SAFE]: Authentication logic for Basic Auth and OAuth 2.0 is correctly implemented using constant-time comparison methods (timingSafeEqual in Node.js and compare_digest in Python) to mitigate timing attacks.\n- [SAFE]: The skill uses a fail-closed approach, ensuring that all incoming webhook batches are rejected by default if no authentication credentials are configured in the environment.\n- [SAFE]: External tool references are limited to the vendor's own verified CLI (hookdeck-cli) for local testing, which is considered a safe reference in the context of a skill authored by hookdeck.\n- [SAFE]: Dependency names in package.json and requirements.txt are standard and established packages. While some versions in the Next.js example are set to non-existent high numbers (e.g., next ^16.3.6, typescript ^7.0.2), these appear to be placeholders rather than malicious supply-chain attacks.

sparkpost-webhooks