skills.rest
timikalo7
timikalo7COMMUNITY
Explore all skills by this author →
GitHub

not-get-sued-101

Implements verified webhook signatures, magic-byte upload validation, and allowlist HTML sanitization.

Updated Jun 9, 2026
Search Tags:#security#xss prevention#webhook verification#hmac signature#file upload validation#magic bytes#html sanitizer
One-click install
npx skills add https://github.com/timikalo7/Execute --skill not-get-sued-101-timikalo7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: not-get-sued-101
Source: https://github.com/timikalo7/Execute/tree/main/.claude/skills/not-get-sued-101
Command: npx skills add https://github.com/timikalo7/Execute --skill not-get-sued-101-timikalo7

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security scanners can flag an unverified webhook, an unvalidated file upload, or a dangerous HTML sink, but they cannot write the fix. This Skill provides tested reference implementations for the three protections scanners can only detect as missing: webhook signature verification, magic-byte file upload validation, and XSS-safe HTML handling. ## Core Features & Use Cases - Webhook Verification: HMAC-SHA256 signature verification over the raw request body with constant-time comparison, timestamp tolerance windows to block replays, and hard rejection of missing headers. - Upload Validation: File type detection by magic bytes (JPEG, PNG, GIF, PDF, WebP) instead of trusting client MIME types or extensions, with size limits, generated storage filenames, and SVG refusal. - XSS Handling: A three-tier approach covering HTML escaping, JSON-LD-safe serialization, and an allowlist HTML sanitizer that strips scripts, event handlers, and javascript:/data: URLs. - Use Case: When a security gate reports webhook-unverified, upload-no-validation, or a dangerous-html warning on your endpoint, use these reference modules to implement the actual protection and prove it with the included 32-assertion self-test. ## Quick Start Ask the agent to apply the not-get-sued-101 reference implementations to fix the webhook, upload, or HTML rendering warnings reported by the security gate, then run the self-test to confirm.

Frequently Asked Questions about not-get-sued-101

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify a Stripe webhook signature in Node.js?▼

Verify the HMAC-SHA256 signature over the raw request body using crypto.timingSafeEqual for comparison, and reject requests whose timestamp falls outside a tolerance window. Never verify a parsed and re-serialized JSON body, since key order changes break the signature.

How do I validate file uploads by magic bytes?▼

Check the file's leading bytes against an allowlist of known signatures for JPEG, PNG, GIF, PDF, and WebP rather than trusting the client MIME type or extension. Reject empty and oversized files first, refuse SVG entirely, and generate the stored filename yourself.

What is the safest way to render user HTML without XSS?▼

Prefer not rendering HTML at all by using textContent or JSX escaping. If user HTML is genuinely required, use an allowlist sanitizer that permits only specific tags, attributes, and URL schemes, and for hostile content at scale use DOMPurify or sanitize-html.

Why does webhook verification fail after parsing the JSON body?▼

Parsing and re-serializing JSON changes key order and whitespace, so the recomputed signature never matches the original. Always verify against the raw body bytes, for example via req.text() in Next.js rather than req.json().

When should I use DOMPurify instead of a custom sanitizer?▼

Use DOMPurify in the browser or sanitize-html on the server when handling hostile user-generated content at scale. The included allowlist sanitizer covers common cases like rich-text fields but is intentionally minimal and not a substitute for a maintained library.

Related Skills

Explore More Software Engineering Skills→
ratnesh-mauryaratnesh-maurya
1

frontend-mobile-security-xss-scan

Detects XSS vulnerabilities in React, Vue, Angular, and vanilla JavaScript code.

Community
Intermediate
hirefrankhirefrank
3

cors-configuration-validator

Validate Cloudflare Workers CORS headers, OPTIONS handling, and origin checks.

Community
Advanced
simoabidsimoabid
1

vulnerability_scanner

Scan projects for OWASP 2025 vulnerabilities, secrets, and risky configurations.

Community
Advanced
lazyFrogLOLlazyFrogLOL
127

filter-js-from-html

Analyze HTML sanitizers and generate JavaScript bypass payloads for security testing.

Community
Intermediate