The Agent Skills Directory

[SAFE]: The skill implements a robust 'fetch-back' pattern to verify the authenticity of unsigned webhooks by re-querying the official ABN AMRO Tikkie API.
[INDIRECT_PROMPT_INJECTION]: The skill defines a data ingestion surface for processing external webhook notifications but includes standard mitigations appropriate for the use case.
Ingestion points: The POST handlers in examples/fastapi/main.py, examples/express/src/index.js, and examples/nextjs/app/webhooks/tikkie/route.ts accept JSON payloads from external sources.
Boundary markers: The code performs strict schema validation and type checking on incoming payloads before processing.
Capability inventory: The skill uses httpx (Python) and fetch (Node.js) to make outgoing requests to Tikkie's API endpoints (api.abnamro.com).
Sanitization: Payloads are validated against expected fields for each notificationType (PAYMENT, REFUND, BUNDLE), and tokens are URL-encoded before being used in fetch-back paths.
[DATA_EXPOSURE]: The skill correctly instructs users to manage sensitive credentials (API Key and App Token) using environment variables and .env files, avoiding hardcoded secrets in the source code.

tikkie-webhooks