The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data via webhook endpoints, creating a theoretical attack surface for indirect prompt injection. However, the implementation follows security best practices.
Ingestion points: Webhook endpoints defined in examples/express/src/index.js (/webhooks/stripe), examples/fastapi/main.py (/webhooks/stripe), and examples/nextjs/app/webhooks/stripe/route.ts (POST handler).
Boundary markers: The skill explicitly implements and documents the use of Stripe's official SDK for signature verification (stripe.webhooks.constructEvent in JavaScript and stripe.Webhook.construct_event in Python), which validates payload integrity and authenticity.
Capability inventory: Handlers are limited to logging event data to the console and provide placeholders for business logic; they do not include dangerous capabilities like shell command execution or direct file system writing.
Sanitization: Verification of the stripe-signature header serves as a robust control against tampered or unauthorized data ingestion.
[SAFE]: No malicious patterns, unauthorized data exfiltration, or suspicious code execution were detected. All external resources, packages, and CLI tools (Stripe and Hookdeck) are well-known and relevant to the skill's stated purpose.

stripe-webhooks