The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted external data via ClickUp webhooks.
Ingestion points: Raw request bytes are ingested via webhook endpoints as described in SKILL.md.
Boundary markers: The instructions specify parsing and validating JSON only after cryptographic verification.
Capability inventory: The skill is granted access to Write and Edit tools to perform repository updates based on events.
Sanitization: The instructions mandate constant-time HMAC-SHA256 verification of the X-Signature header against a server-side secret before any data processing.
[EXTERNAL_DOWNLOADS]: The skill references documentation and a demonstration repository from ClickUp.
Evidence: Links to developer.clickup.com and github.com/clickup/clickup-APIv2-demo are provided for developer reference.
Context: These sources belong to ClickUp, a well-known technology service, and are used solely for informational purposes.

clickup-webhooks-events