The Agent Skills Directory

[SAFE]: The skill implements industry-standard security practices for webhook handling, specifically targeting WeChat Pay's APIv3 requirements.
[CREDENTIALS_SAFE]: The skill uses environment variables for sensitive information (APIv3 keys and platform certificates) and provides .env.example files with non-sensitive placeholders. No real production credentials or private keys are exposed in the examples or tests.
[COMMAND_EXECUTION]: The documentation includes the use of npx hookdeck-cli for local development. This is a legitimate utility provided by the vendor (Hookdeck) to tunnel webhooks for testing and does not pose a security risk in this context.
[DATA_EXPOSURE]: The skill includes comprehensive verification steps (RSA signature and timestamp checks) to prevent unauthorized or stale data processing. It also correctly advises users to re-verify order details against their internal database before fulfillment.
[EXTERNAL_DOWNLOADS]: Dependencies listed in package.json and requirements.txt are standard, well-known libraries (e.g., express, fastapi, cryptography) used for web development and cryptographic operations.

wechat-webhooks