The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process external data from webhook notifications. It effectively mitigates potential injection risks by providing and mandating an HMAC-SHA256 signature validation pattern. The documentation explicitly warns to 'Never trust the JSON body alone — always validate the signature first.'
Ingestion points: req.body (webhook payload) identified in SKILL.md reference snippet.
Boundary markers: Explicit instructions to validate headers before processing body.
Capability inventory: Uses vendor-provided MCP tools (save_webhook, notifications_history) and built-in Node.js crypto modules.
Sanitization: Implements signature verification using a shared secret to ensure data integrity and authenticity.
[DATA_EXPOSURE]: The skill follows secure secret management practices by instructing developers to use environment variables (process.env.MP_WEBHOOK_SECRET) rather than hardcoding credentials.
[COMMAND_EXECUTION]: The skill uses built-in Node.js functionality for HMAC computation and does not involve any shell command execution or risky system calls.

mp-webhooks