The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill sets up infrastructure to receive webhooks from Square, creating an entry point for external data.
Ingestion points: POST endpoints in examples/express/src/index.js, examples/nextjs/app/webhooks/square/route.ts, and examples/fastapi/main.py.
Boundary markers: Cryptographic signature verification using the x-square-hmacsha256-signature header is implemented in all provided examples.
Capability inventory: The handlers perform event logging and provide switch statements for business logic; no dangerous system-level capabilities are exposed to the webhook payload.
Sanitization: Authenticity is strictly enforced by verifying the HMAC-SHA256 signature of the raw request body before JSON parsing.
[CREDENTIALS_UNSAFE]: The skill uses environment variables (SQUARE_WEBHOOK_SIGNATURE_KEY) for secret management. Examples correctly demonstrate the use of .env.example with placeholders, ensuring no real secrets are hardcoded.
[SAFE]: The skill uses the official square Node.js SDK for verification and suggests standard development tools like hookdeck-cli for local testing.

square-webhooks