The Agent Skills Directory

[SAFE]: The skill demonstrates legitimate integration with PostHog, a well-known analytics service. The provided code for webhook processing includes signature verification using HMAC-SHA256 and timing-safe comparisons, which are standard security measures to prevent spoofing and timing attacks.
[SAFE]: Credentials and sensitive information (PostHog API keys, Slack webhook URLs, HubSpot API keys) are correctly managed using environment variables and shell variables, avoiding the risk of hardcoded secrets.
[SAFE]: All network operations (using curl and fetch) are directed toward established and trusted service endpoints such as app.posthog.com, api.hubspot.com, and slack.com for their intended functional purposes. No suspicious exfiltration or remote code execution patterns were detected.

posthog-webhooks-events