The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements a server-side proxy in references/src/proxy.ts to manage communication with the iGrant.io API. This design correctly prevents sensitive API keys from being exposed to the client-side. The proxy is limited to specific verification endpoints using a permitted path list, adhering to the principle of least privilege.
[INDIRECT_PROMPT_INJECTION]: The application exposes an endpoint for receiving external webhooks in references/src/webhooks.ts. The skill mitigates risks associated with untrusted data ingestion by requiring HMAC signature verification (X-iGrant-Signature) using crypto.timingSafeEqual and strictly validating the payload type against a predefined schema.
[EXTERNAL_DOWNLOADS]: The reference implementation depends on standard, well-known Node.js libraries (express, cors, dotenv). These are properly defined in package.json with specific versions.
[COMMAND_EXECUTION]: A CLI utility is provided for webhook registration. It operates by making authenticated HTTP requests to the vendor's configuration API using provided environment credentials.

igrantio-verifier-backend