The Agent Skills Directory

[SAFE]: The skill provides educational examples and boilerplate code for receiving Twitch webhooks using standard frameworks like Express, Next.js, and FastAPI.
[SAFE]: Signature verification logic correctly implements timing-safe comparisons (such as crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing attacks, which is a critical security requirement for webhook handlers.
[SAFE]: Replay protection is correctly implemented by validating the Twitch-Eventsub-Message-Timestamp header against a 10-minute window, mitigating common replay attack vectors.
[SAFE]: All external tool recommendations, including hookdeck-cli, are vendor-owned resources from the skill's author (hookdeck) and are used appropriately for local development and tunneling purposes.

twitch-webhooks