The Agent Skills Directory

[SAFE]: The skill implements cryptographic signature verification using HMAC-SHA256 with timing-safe comparison (via crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing attacks.
[SAFE]: Replay protection is correctly implemented by validating the Request-Timestamp against the current system time with a 5-minute (300 seconds) tolerance window.
[SAFE]: Verification logic properly handles secret rotation by splitting the Synctera-Signature header on the period delimiter and validating the payload against each potential signature candidate.
[SAFE]: Documentation and examples correctly advise developers to perform verification against the raw request body rather than parsed JSON to ensure signature integrity.
[EXTERNAL_DOWNLOADS]: The skill references standard development dependencies and the author's own hookdeck-cli for local testing, all of which are appropriate for the skill's stated purpose.

synctera-webhooks