The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the official Pachca CLI tool using npx -y @pachca/cli for managing bot configurations and tokens.
[COMMAND_EXECUTION]: The skill uses the pachca CLI to perform administrative tasks such as creating bots, rotating tokens, and updating webhook URLs.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data through incoming webhooks. To mitigate risks, the documentation provides specific guidance on verifying the Pachca-Signature using HMAC-SHA256 and validating the webhook_timestamp to ensure the authenticity and freshness of the received data.
Ingestion points: Webhook payloads received at user-defined endpoints as described in references/handle-incoming-webhook-event.md and references/webhook-events.md.
Boundary markers: None explicitly defined for prompt isolation, but the signature check acts as a data-layer boundary.
Capability inventory: File writes (indirectly via CLI configuration), network operations (via CLI interaction with Pachca API), and command execution (Bash(pachca:*)).
Sanitization: Verification of HMAC-SHA256(Signing secret, raw body) against the Pachca-Signature header is documented as a security requirement in references/webhook-events.md.

pachca-bots