The Agent Skills Directory

[SAFE]: The skill demonstrates secure development practices for handling external events. It explicitly mandates and provides code for verifying RS256 JWT signatures on all incoming requests before processing the payload, preventing unauthorized data injection.
[EXTERNAL_DOWNLOADS]: The skill references standard, reputable libraries from official registries (NPM and PyPI). These include official Wix SDKs (@wix/sdk, @wix/ecom) and well-known framework/security libraries (fastapi, express, PyJWT).
[INDIRECT_PROMPT_INJECTION]: The skill implements endpoints that ingest untrusted external data from Wix.
Ingestion points: Webhook route handlers in examples/express/src/index.js, examples/nextjs/app/webhooks/wix/route.ts, and examples/fastapi/main.py.
Boundary markers: Strict RS256 JWT signature verification using the app's public key is performed before any data is parsed or used.
Capability inventory: The example handlers are restricted to logging and local logic; no dangerous capabilities such as shell execution, network exfiltration of local files, or arbitrary file system writes are present.
Sanitization: The skill uses library-standard JSON parsing and JWT decoding to extract data from the verified payload.

wix-webhooks