The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents the processing of untrusted data via webhook endpoints.
Ingestion points: HTTP POST endpoints defined in SKILL.md (e.g., /webhooks/stripe, /webhooks/github).
Boundary markers: Explicitly implements and mandates HMAC signature verification to ensure data integrity and authenticity.
Capability inventory: Database operations (Drizzle ORM), background job queuing (BullMQ), and outbound fetch requests for webhook delivery.
Sanitization: Uses cryptographic verification with timing-safe comparisons (crypto.timingSafeEqual) to validate external payloads before processing.
[COMMAND_EXECUTION]: Includes documentation for using the stripe CLI and ngrok for local development and testing of webhook integrations.
[EXTERNAL_DOWNLOADS]: References standard Node.js libraries such as stripe and express for implementing the webhook handlers.

webhook-patterns