The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes instructions to use hookdeck-cli, a legitimate development tool for forwarding webhooks to local environments. These commands are provided for testing purposes and do not execute arbitrary or malicious code.
[CREDENTIALS_UNSAFE]: Environment variable templates (.env.example) and code correctly reference STATSIG_WEBHOOK_SECRET for signature verification. No hardcoded secrets or sensitive credentials were found. Documentation correctly advises users to treat the signing secret like a password and avoid committing or logging it.
[EXTERNAL_DOWNLOADS]: Dependencies listed in package.json and requirements.txt (e.g., express, fastapi, vitest, pytest) are standard, well-known libraries from official registries (NPM and PyPI). The skill does not download or execute scripts from untrusted remote sources.
[DATA_EXFILTRATION]: There is no evidence of unauthorized data access or transmission to external domains. The network operations are limited to the intended purpose of receiving webhook POST requests on a local server.
[PROMPT_INJECTION]: The skill instructions focus on implementation logic and do not contain patterns designed to override agent behavior or bypass safety filters.

statsig-webhooks