The Agent Skills Directory

[SAFE]: The skill correctly implements security best practices for webhook handling by using the official @paddle/paddle-node-sdk to perform HMAC signature verification via the unmarshal method.
[SAFE]: Instructions for handling sensitive credentials (API keys and webhook secrets) follow industry standards, advising the use of server-side environment variables and explicitly warning against exposing them to the client browser.
[SAFE]: The logic for event processing includes robust recommendations for idempotency and order-safety, such as using atomic database UPSERTs keyed on Paddle resource IDs and checking the occurredAt timestamp to prevent out-of-order execution.
[SAFE]: All external resources mentioned, including the @paddle/paddle-node-sdk package and the PaddleHQ/paddle-nextjs-starter-kit GitHub repository, are official vendor resources belonging to the skill author (Paddle).

paddle-webhooks