The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's documentation and examples recommend using npx hookdeck-cli. This command fetches and executes the Hookdeck CLI utility from the npm registry to enable local webhook development. As Hookdeck is the official author of the skill, this is an expected use of a vendor-provided tool.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data via Vercel webhook events, creating a potential attack surface that is well-mitigated in the provided code.
Ingestion points: REST API endpoints for receiving POST requests at /webhooks/vercel, as implemented in the provided Express, FastAPI, and Next.js templates.
Boundary markers: The implementation consistently requires and validates the x-vercel-signature header using HMAC-SHA1, ensuring the request's origin and integrity before any data is processed.
Capability inventory: The example handlers are restricted to logging metadata and specific payload properties to the console. They do not perform high-risk operations such as file writing, shell command execution, or outbound network calls based on the event data.
Sanitization: Webhook payloads are parsed as JSON only after successful signature verification, providing a strong defense against untrusted data ingestion.

vercel-webhooks