The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's sample code fetches Volume's RSA public keys from the provider's official domains (api.sandbox.volumepay.io and api.volumepay.io) to verify webhook signatures. This is a standard and expected operation for asymmetric signature verification.
[COMMAND_EXECUTION]: The documentation and examples provide standard commands for environment setup, including package installation via pip and npm, and running local webhook listener tunnels via npx hookdeck-cli.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted webhook payloads from the internet.
Ingestion points: Webhook endpoints (/webhooks/volume) in the FastAPI, Express, and Next.js examples receive raw request bodies from external sources.
Boundary markers: None explicitly for LLM contexts, as the code is intended for standard backend execution rather than direct LLM ingestion.
Capability inventory: The skill uses networking libraries (httpx, fetch) and cryptography modules but does not execute shell commands or dynamic code based on the webhook payload.
Sanitization: All examples strictly verify the SHA256withRSA signature over the raw request body before parsing the JSON content, preventing the processing of unauthenticated or tampered data.

volume-webhooks