The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references several well-known libraries for Node.js and Python (e.g., Express, Next.js, FastAPI, Vitest, Pytest) within its example configurations. While the version numbers provided in the examples (such as Next.js 16 and TypeScript 7) appear to be future-dated placeholders, the package names themselves are legitimate and point to established official registries.
[COMMAND_EXECUTION]: Documentation for the skill suggests the use of 'hookdeck-cli' via npx for local development. This is a standard utility provided by the skill author (hookdeck) to facilitate local webhook testing and development.
[DATA_EXFILTRATION]: The skill correctly implements security practices for handling sensitive data. It uses environment variables (TALLY_SIGNING_SECRET) to manage secrets and ensures that webhook payloads are processed locally. No unexpected network calls to untrusted domains were detected.
[SAFE]: Cryptographic verification of the 'Tally-Signature' header is implemented correctly using raw request body buffers/strings and timing-safe comparison methods (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python).

tally-webhooks