The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill demonstrates secure secret management by accessing API keys and webhook secrets via environment variables (process.env) rather than hardcoding sensitive strings.
[COMMAND_EXECUTION]: The skill does not contain any arbitrary command execution, privilege escalation (e.g., sudo), or persistence mechanisms.
[DATA_EXFILTRATION]: Network operations are localized to functional tasks such as fetching generated presentation exports and sending status updates to configured callback URLs.
[INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing data from the Gamma API and external webhook sources, which constitutes a standard ingestion surface.
Ingestion points: API poll results in SKILL.md and webhook payloads in references/implementation.md.
Boundary markers: Webhook authenticity is verified via HMAC signatures, though specific delimiters for processing untrusted strings in prompts are not shown.
Capability inventory: The skill utilizes Read, Write, and Edit tools alongside standard network fetch calls.
Sanitization: Signature verification is present; however, general input validation on the event payloads is left to the implementer.

gamma-webhooks-events