The Agent Skills Directory

[SAFE]: The skill implements best practices for handling unsigned webhooks. It provides clear guidance on using a long random token in the URL query string and comparing it using constant-time equality functions (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing attacks.
[SAFE]: The code correctly implements a 'fail closed' security posture, where the webhook handlers will return a 500 Internal Server Error if the required security token is not configured in the environment, rather than defaulting to an open state.
[SAFE]: The skill emphasizes treating the incoming payload as an 'untrusted hint' and provides helpers to re-fetch authoritative data from the official WordPress.com API (public-api.wordpress.com). This is a well-known service and the communication is conducted over HTTPS.
[SAFE]: All dependencies listed in the Next.js, Express, and FastAPI examples are standard, well-known libraries from official registries (npm, PyPI) at reasonable version ranges. No suspicious or unversioned packages were identified.
[INDIRECT_PROMPT_INJECTION]: The skill acknowledges that webhook bodies (e.g., post_content, comment_content) contain untrusted user data. It provides explicit documentation warning users not to render or publish this content blindly and recommends sanitization and authoritative re-fetching as primary defenses. The risk surface is appropriately documented and mitigated by the recommended architectural patterns.

wordpress-com-webhooks