The Agent Skills Directory

[SAFE]: The skill correctly implements HMAC-SHA256 signature verification using the Node.js crypto module, ensuring that webhook requests are authentic and have not been tampered with during transit.\n- [SAFE]: Replay protection is effectively implemented by validating the timestamp provided in the ElevenLabs-Signature header against a 300-second expiration window to mitigate replay attacks.\n- [SAFE]: The implementation uses crypto.timingSafeEqual to compare signatures, which is a security best practice to prevent timing-based side-channel attacks.\n- [SAFE]: The guide follows standard security practices for secret management by retrieving sensitive credentials from environment variables (process.env.ELEVENLABS_WEBHOOK_SECRET) rather than hardcoding them in source files.

elevenlabs-webhooks-events