Individual skill
webhooks
Use when building the receiving end of a webhook — a provider-agnostic endpoint that proves pushed events are authentic and never processes one twice: raw-body HMAC, ~5-min replay window, idempotency on the event id, fast-ack-then-queue. NOT the Stripe-Signature scheme (that is stripe), NOT outbound clients you call (that is api-connector-builder).
skills/webhooks/SKILL.md
Source commit d9d6bb338f66cc1e23998585e580a0ea45bbcb82
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 554
- Repository last updated
- Nov 4, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- agentic-ai Repository topic
- ai-agents Repository topic
- ai-coding Repository topic
- claude-code Repository topic
- cli Repository topic
- cline Repository topic
- codex Repository topic
- coding-assistant Repository topic
- cursor Repository topic
- webhooks Declared skill tag
- inbound-webhooks Declared skill tag
- hmac-verification Declared skill tag
- idempotency Declared skill tag
- signature-verification Declared skill tag
- queue Declared skill tag
- connectors Declared skill tag
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 12,312 bytesSKILL.mdcore · 12,312 bytesSKILL.mdcore · 12,312 bytesevals/README.mddoc · 1,024 bytesevals/cases.yamlasset · 4,219 bytesreferences/framework-raw-body.mddoc · 3,632 bytesreferences/signature-schemes.mddoc · 3,548 bytesscripts/verify.shruns · 6,418 bytes
Read excerpt
# Webhooks — the inbound front door that survives retries and forgeries
You are building the side of a webhook that *receives*. Some external system
pushes an HTTP POST at your endpoint; your job is to prove it is real, refuse to
act on it twice, and answer fast. That is the whole mandate.
This skill is provider-agnostic — it teaches the mechanics every webhook source
shares, not any one vendor's event catalog — and it ends at "enqueued." What
happens to the event afterward is a different job:
- The Stripe-specific scheme (`Stripe-Signature`, `t=,v1=`, `stripe listen`,
the event model) → `../stripe/SKILL.md`.
- Email bounce/complaint webhooks where the point is suppression state →
`../email-connector/SKILL.md`.