The Agent Skills Directory

[SAFE]: The skill demonstrates a strong security posture by implementing timing-safe signature verification using timingSafeEqual and providing clear documentation on signature algorithms for different providers.\n- [EXTERNAL_DOWNLOADS]: Includes instructions for interacting with the official REST APIs of well-known and trusted services, such as Vercel and GitHub, for webhook registration purposes.\n- [COMMAND_EXECUTION]: Provides standard operational and debugging commands for the developer, including the use of openssl for manual HMAC testing and the author's own joelclaw CLI for service management.\n- [CREDENTIALS_UNSAFE]: Features a secure secret management workflow that utilizes a leasing system (secrets lease) to provision environment variables at runtime, effectively preventing the use of hardcoded credentials.\n- [PROMPT_INJECTION]: Identifies a surface for indirect prompt injection as the gateway processes external webhook payloads. Ingestion points: Webhook endpoints defined in SKILL.md (e.g., /webhooks/todoist). Boundary markers: The prompt-building logic in new-provider-checklist.md uses Markdown headers to delimit external data. Capability inventory: The system can trigger Inngest functions and push notifications to the joelclaw gateway. Sanitization: The provided TypeScript templates extract specific fields but do not explicitly show sanitization of external strings before prompt interpolation.

webhooks