The Agent Skills Directory

[SAFE]: The skill provides standard webhook handling templates. It includes explicit warnings about the lack of cryptographic signatures in the Zift protocol and recommends compensating controls such as HTTPS, endpoint URL secrecy, and IP allowlisting to maintain security.
[EXTERNAL_DOWNLOADS]: The skill references the hookdeck-cli tool for local testing and recommends the webhook-handler-patterns skill. Both are official resources from the skill author, Hookdeck, intended for development and implementation of best practices.
[PROMPT_INJECTION]: The skill documents a surface for indirect prompt injection by accepting and processing JSON data from external webhook endpoints. The ingestion of untrusted data is a functional requirement for a webhook receiver.
Ingestion points: The POST /webhooks/zift route in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/zift/route.ts.
Boundary markers: None present to delimit external data from instructions.
Capability inventory: Console logging and conditional branching based on the eventCode field. No dangerous capabilities (e.g., shell execution, file writes) are present in the provided templates.
Sanitization: Employs standard JSON parsing with type checking for specific fields like notificationId and eventCode.

zift-webhooks