The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from external USPS webhook notifications, which could contain malicious instructions targeting the agent's logic (Indirect Prompt Injection).
Ingestion points: Webhook request bodies are parsed in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/usps/route.ts.
Boundary markers: None; the JSON payload is processed directly without delimiters.
Capability inventory: Example handlers perform logging and logic dispatching based on tracking status. While currently benign, this pattern can be used for more sensitive operations.
Sanitization: No validation or sanitization of the payload content is performed before logging or use in control flow.
[EXTERNAL_DOWNLOADS]: The skill's example configuration files reference external dependencies with unrealistic version numbers.
Evidence: References to next@16.2.11, typescript@7.0.2, vitest@4.1.10, jest@30.4.2, fastapi>=0.139.2, and pytest>=9.1.1 in package.json and requirements.txt. These versions are significantly higher than the current stable releases.
[COMMAND_EXECUTION]: Documentation suggests executing a CLI tool for local development.
Evidence: npx hookdeck-cli listen ... in SKILL.md and project READMEs. This command downloads and runs a tool from the skill's author.

usps-webhooks