The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documents the devMode functionality, which triggers the SDK to download the official QStash CLI binary for local development purposes. This resource is provided by the vendor Upstash and is used to simulate the QStash service environment locally.\n- [REMOTE_CODE_EXECUTION]: When devMode is enabled, the SDK facilitates the execution of the downloaded QStash binary to start a local development server. This allows developers to test their integration end-to-end without a live cloud connection.\n- [DYNAMIC_EXECUTION]: The SDK spawns the QStash CLI as a child process during local development to manage message processing and deterministic credentials for testing. This execution is contained within the local development environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from webhooks, which presents a surface for potential indirect prompt injection attacks.\n
Ingestion points: Incoming request bodies are processed for signature verification and application logic in the Receiver class and framework-specific verifiers as seen in verification/receiver.md and verification/platform-specific/nextjs.md.\n
Boundary markers: The documentation strongly advises using signature verification to validate and delimit all incoming traffic.\n
Capability inventory: The SDK allows for publishing JSON payloads to arbitrary URLs and configuring recurring tasks, which could be exploited if malicious data is trusted, as described in fundamentals/publishing-messages.md.\n
Sanitization: The SDK implements JWT-based signature verification to ensure incoming requests are authentic and originate from the QStash service.\n- [COMMAND_EXECUTION]: The skill includes a utility script advanced/multi-region/verify-multi-region-setup.ts for verifying multi-region environment variable configurations. This script reads and displays masked configuration values to the console to help troubleshoot deployment settings.

upstash-qstash-js