The Agent Skills Directory

[SAFE]: The skill demonstrates secure webhook handling for Stripe, GitHub, and generic HMAC providers.- [SAFE]: It correctly implements security best practices such as verifying signatures before processing payloads, using timing-safe comparisons (crypto.timingSafeEqual) to prevent timing attacks, and processing raw request bodies to ensure signature integrity.- [SAFE]: It promotes defense-in-depth by including an idempotency pattern using Redis to protect against replay attacks and duplicate processing.- [SAFE]: Sensitive data is handled appropriately through environment variables (process.env), with no hardcoded secrets or suspicious network operations detected.

webhook-security