The Agent Skills Directory

[SAFE]: The skill implements robust security practices for webhook handling, specifically using HMAC-SHA256 signature verification to authenticate incoming requests from Xero.
[SAFE]: Code examples demonstrate the use of timing-safe comparison functions (crypto.timingSafeEqual in Node.js and hmac.compare_digest in Python) to prevent timing attacks during signature validation.
[SAFE]: Documentation correctly advises capturing the raw request body before JSON parsing to ensure signature integrity, which is a common point of failure in webhook implementations.
[SAFE]: The skill uses environment variables for sensitive configuration like the Xero webhook signing key and provides .env.example files to prevent accidental credential leakage.

xero-webhooks