CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

paddle-webhooks

Receive and verify Paddle webhooks in a Next.js Route Handler — signature verification, idempotency, retry semantics, and local testing.

72

1.20x
Quality

84%

Does it follow best practices?

Impact

100%

1.20x

1 of 3 eval scenarios. Add 2 more for a full score.

SecuritybySnyk

Medium

Suggest reviewing before use

The canonical home for this skill is paddle-webhooks in PaddleHQ/paddle-agent-skills

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a strong, highly actionable skill: complete executable code, a well-sequenced workflow, and an unusually good verification checklist with deliberate failure injection. Its weaknesses are structural — a 340-line monolithic file with no progressive disclosure into reference files — plus repeated restatement of the 401-vs-500 retry rationale.

Suggestions

Move the generic Paddle MCP conventions block (camelCase method paths, snake_case body params, pagination shape, execute/timeout caps) into a shared references file (e.g. references/paddle-mcp.md) and keep a one-line pointer in the body — it is not webhook-specific and inflates the main file.

State the "all non-2xx responses are retried equally, so pick one status for the whole catch" rationale once (ideally in Common pitfalls) and trim the other three restatements in Step 3.

Consider splitting the pitfalls and simulator walkthrough into a references/ file so SKILL.md stays a lean overview with well-signaled one-level-deep references.

DimensionReasoningScore

Conciseness

The body is dense with non-obvious, Paddle-specific facts ("Only 2xx within 5 seconds is 'delivered'", "Sandbox: 3 attempts within 15 minutes. Live: 60 attempts within 3 days") and assumes competence, but the "all non-2xx retried equally, don't split 401/500" rationale is stated four times (Step 3 intro, the catch-block comment, Step 3 prose, and the pitfalls list) and the long generic MCP conventions block is only partially webhook-relevant — minor over-explanation that could be trimmed, so not 5.

4 / 5

Actionability

Fully executable, copy-paste-ready code throughout: the route handler, the SDK singleton, the EventName switch with typed narrowing, the guarded UPSERT SQL with an occurredAt predicate, and the event-id ledger with a transaction and CREATE TABLE DDL — plus install commands, env vars, and dashboard click-paths covering the common cases.

5 / 5

Workflow Clarity

Steps 1–6 are clearly sequenced from destination creation through verification, and the "Verify the integration" section is an explicit validation checklist with a real feedback loop: log the event, run a simulation, confirm 200, deliberately tamper the secret, confirm the non-2xx failure, restore, and confirm recovery — checkpoints are explicit, not implicit.

5 / 5

Progressive Disclosure

No bundle files exist (references/, scripts/, assets/ are all absent), so the entire ~340-line skill is one monolithic file; content that clearly belongs in separate reference files is inlined — notably the generic Paddle MCP conventions block (camelCase/snake_case rules, pagination, caps) and the 12-item pitfalls list. Internal section headers are good, keeping it above a 2, but there are no one-level-deep file references at all, keeping it below a 4.

3 / 5

Total

17

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, concrete, and highly distinctive, naming the exact domain and five real capabilities. Its one material weakness is the missing explicit "when to use" trigger clause, which caps completeness and leaves natural trigger synonyms uncovered.

Suggestions

Add an explicit trigger clause, e.g. "Use when building the endpoint that receives Paddle webhook events or when the user mentions Paddle webhooks, notification destinations, or webhook signature verification."

Include natural trigger synonyms users might say, such as "webhook endpoint", "Paddle notifications", or "event handler", to broaden trigger-term coverage.

Consider signaling the runtime scope (Next.js App Router) more explicitly so it doesn't silently miss Pages Router users looking for the same task.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — "Receive and verify Paddle webhooks", "signature verification, idempotency, retry semantics, and local testing" — which comprehensively cover the webhook-integration domain, matching the top anchor rather than leaving minor gaps.

5 / 5

Completeness

The "what" is clear (receive/verify/process Paddle webhooks in Next.js), but there is no "Use when..." clause or equivalent explicit trigger guidance, capping completeness at 3 per the rubric guideline; the "when" is only weakly implied by naming the domain.

3 / 5

Trigger Term Quality

"Paddle webhooks", "Next.js Route Handler", and "verify" are natural phrases a user would say, but common synonyms like "webhook endpoint", "Paddle notifications", or "event delivery" are absent — good coverage with a few natural terms missing, so not 5.

4 / 5

Distinctiveness Conflict Risk

"Paddle webhooks in a Next.js Route Handler" carves out a clear niche with distinct triggers ("Paddle", "webhook", "Route Handler") that would not fire for sibling skills like subscription-sync or checkout-web — minimal conflict risk.

5 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

PaddleHQ/paddle-agent-skills

Path

providers/claude/plugin/skills/webhooks/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.