The Agent Skills Directory

[SAFE]: The skill correctly implements and promotes the use of the official svix SDK for signature verification, which handles complex tasks like HMAC-SHA256 verification, timestamp validation, and constant-time comparison.
[SAFE]: Instructions explicitly warn against re-serializing JSON payloads before verification, which is a common security pitfall that breaks signature validation.
[SAFE]: All sensitive data, such as signing secrets, are managed via environment variables. The provided .env.example files use placeholders and do not contain hardcoded credentials.
[SAFE]: External tool usage is limited to npx hookdeck-cli for local testing, which is a tool provided by the author (hookdeck) for development purposes.
[SAFE]: The skill's event handling logic is designed as a template for logging and dispatching, with no dangerous operations like arbitrary code execution or filesystem access based on untrusted webhook data.

svix-webhooks