The Agent Skills Directory

[SAFE]: The skill provides instructional content and boilerplate code for receiving and verifying Statsig Event Webhooks (Generic Webhooks). The implementation uses standard cryptographic libraries for HMAC-SHA256 signature verification.
[EXTERNAL_DOWNLOADS]: The documentation suggests using hookdeck-cli via npx for local development. This is a legitimate utility provided by the skill's author (hookdeck) for webhook tunneling and local testing.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by using environment variables (e.g., STATSIG_WEBHOOK_SECRET) for sensitive signing secrets instead of hardcoding them. Example .env files contain benign placeholders.
[COMMAND_EXECUTION]: The provided scripts are standard web servers (Express, FastAPI, Next.js) and do not contain arbitrary command execution or suspicious subprocess calls. Logic is focused on parsing webhook payloads and logging event metadata.
[INDIRECT_PROMPT_INJECTION]: The skill's handlers ingest untrusted data from incoming webhooks. However, the provided examples only perform logging and do not feed this data into dangerous sinks or agent instructions, making the surface risk negligible.

statsig-webhooks