The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data from Supabase webhooks, which constitutes an indirect prompt injection surface. However, the skill provides robust mitigations and implementation guidance to handle this safely.
Ingestion points: The skill provides webhook receiver templates in examples/express/src/index.js, examples/nextjs/app/webhooks/supabase/route.ts, and examples/fastapi/main.py that parse external JSON payloads.
Boundary markers: The skill does not explicitly define LLM boundary markers within the code logic, as it focuses on standard web service implementation. However, it emphasizes strict cryptographic verification of the source.
Capability inventory: The handlers have standard access to environment variables (for secrets) and logging. The code includes placeholders (TODOs) for custom business logic like database writes or email enqueuing.
Sanitization: The examples demonstrate proper signature verification using HMAC-SHA256 for Auth Hooks and constant-time secret comparison for Database Webhooks, ensuring that only authentic data from Supabase is processed.
[EXTERNAL_DOWNLOADS]: The skill references and includes package manifests for standard libraries and developer tools.
The package.json and requirements.txt files in the examples directory list well-known dependencies such as express, fastapi, standardwebhooks, and next.
The documentation recommends the use of npx hookdeck-cli, a tool provided by the skill's author (Hookdeck) for local development and tunneling.
Some version strings in the example package.json files (e.g., typescript@^7.0.2, next@^16.3.3) appear to be placeholders or future-dated versions used for demonstration purposes in documentation rather than production-ready pins.

supabase-webhooks