The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data received from external network requests (webhooks).
Ingestion Points: Webhook handlers in SKILL.md (Next.js and Express examples) ingest raw payload data using request.text() and req.body.toString().
Boundary Markers: The skill explicitly instructs the implementation of signature verification using the X-Recur-Signature header and HMAC-SHA256 authentication (via recur.webhooks.verify) to validate the data source.
Capability Inventory: The processing logic includes database writes for event logging (db.webhookEvent.create) and various business logic handlers for subscription management.
Sanitization: The primary defense mechanism is the mandatory cryptographic signature verification which ensures that only authenticated payloads from the service provider are processed.
[COMMAND_EXECUTION]: The file scripts/test-webhook.sh is a bash utility for development and testing.
Evidence: The script uses openssl to generate HMAC signatures and curl to transmit JSON payloads to a user-specified local endpoint.
Analysis: The script functions as a testing tool for developers to simulate incoming webhooks and does not exhibit malicious behavior or fetch remote code.

recur-webhooks