The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation suggests using npx hookdeck-cli for local development and testing. This is a tool provided by the vendor (hookdeck) to facilitate webhook tunneling and local inspection.
[SAFE]: The provided implementation examples (Next.js, Express, and FastAPI) correctly handle webhook security by verifying the TikTok-Signature header using HMAC-SHA256 against the raw request body before any data parsing occurs.
[SAFE]: The skill demonstrates the use of timing-safe comparison functions (e.g., crypto.timingSafeEqual and hmac.compare_digest) to prevent timing side-channel attacks during signature validation.
[SAFE]: Replay protection is implemented by validating the timestamp (t) in the signature header against a tolerance window (defaulting to 300 seconds), ensuring that captured and re-sent requests are rejected.

tiktok-webhooks