The Agent Skills Directory

[SAFE]: The skill implements cryptographic best practices for webhook verification, including the use of HMAC-SHA512, hashing the raw request body, and employing constant-time string comparisons to mitigate timing attacks.- [EXTERNAL_DOWNLOADS]: The documentation and examples suggest using npx hookdeck-cli for local development and webhook forwarding. This is a legitimate tool provided by the skill's author (hookdeck) for development and debugging purposes.- [INDIRECT_PROMPT_INJECTION]: The skill establishes an endpoint for ingesting external data via webhooks. * Ingestion points: The POST /webhooks/upollo endpoint defined in the Next.js, Express, and FastAPI example implementations. * Boundary markers: The implementation creates a cryptographic boundary by verifying the Upollo-Signature using a shared secret before parsing or acting on the payload. * Capability inventory: The provided handlers are limited to logging and logic for handling Upollo-specific flags; they do not contain dangerous capabilities such as arbitrary command execution, dynamic code loading, or unauthorized file system access. * Sanitization: Authenticity is verified against the raw request body bytes to ensure the content has not been tampered with before JSON parsing.- [SAFE]: The skill provides explicit warnings regarding the operational status of the Upollo service, advising users to verify the service's availability and re-validate the signature scheme against live deliveries before production use.

upollo-webhooks