The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill designs systems to ingest data from external sources (webhooks and Realtime events), creating a surface for indirect prompt injection.
Ingestion points: Event data is received via req.json() and req.text() in Edge Functions (edge-function-receivers.md) and the payload object in Realtime subscriptions (listen-notify-realtime.md).
Boundary markers: The templates include instructions for HMAC signature verification using the x-webhook-signature header, which validates the sender's identity but does not provide a mechanism for sanitizing data content against prompt injection if it is later consumed by an LLM.
Capability inventory: The provided handlers have database write capabilities (supabase.from().insert()) and can perform conditional logic based on payload content.
Sanitization: The skill implements HMAC verification and idempotency checks to prevent spoofing and duplicate processing, which are robust security measures for the event-driven pattern.
[EXTERNAL_DOWNLOADS]: The TypeScript templates reference external dependencies from well-known and established sources.
Evidence: Fetches the Supabase JavaScript library from the esm.sh CDN and Deno standard library modules from deno.land.
[COMMAND_EXECUTION]: The skill requires and uses tools for interacting with Supabase infrastructure as part of its primary functionality.
Evidence: Instructs the use of the supabase CLI for local development, environment management, and function deployment, as well as curl for testing webhook endpoints.

supabase-webhooks-events