CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

agentmail-webhooks

Receive and verify AgentMail webhooks (email inboxes for AI agents). Use when setting up AgentMail webhook handlers, debugging Svix signature verification (svix-id, svix-timestamp, svix-signature, whsec_ secret), deduplicating on event_id, or handling events like message.received, message.sent, message.delivered, message.bounced, message.complained, message.rejected, message.opened, message.security.review, domain.verified and calendar.event.starting.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, high-quality body: executable verification code, precise delivery semantics, and a smart event_id dedup insight, all with clean reference structure. The main defects are the missing examples/ directories referenced for complete handlers, the absence of a dedup code example, and some trimmable promotional sections.

Suggestions

Remove or repair the references to examples/express/, examples/nextjs/, and examples/fastapi/ — these directories are not in the bundle, so the 'complete handlers with tests' pointer leads nowhere. Either ship the example handlers or replace the links with a minimal inline handler skeleton.

Add a short executable deduplication snippet (e.g., a keyed cache/DB check on event_id returning early on conflict) to match the concreteness of the verification section, since dedup is presented as a core concern.

Trim the 'When to Use This Skill' question list (it duplicates the frontmatter description) and condense the 13-item 'Related Skills' list to the few most relevant entries to reclaim token budget.

DimensionReasoningScore

Conciseness

The technical core is lean and packed with non-obvious facts (svix 2.x return-value gotcha, retry schedule, 15-second window, event_id vs svix-id) with zero basic-concept padding, but the 6-bullet 'When to Use' section duplicates the description and the 13-item 'Related Skills' list plus attribution block could be trimmed.

4 / 5

Actionability

Mostly copy-paste ready: a complete JS verification function with error paths, a Python one-liner, a concrete hookdeck-cli command, and the env var with its retrieval path. The gap is deduplication — the skill's second core task — which is explained but lacks any executable snippet.

4 / 5

Workflow Clarity

The handler flow is well defined per section and the sequence is stated ('Verify first, parse second, handle idempotently third') with validation checkpoints in the verification code (fail closed → 500, WebhookVerificationError → 400), but the end-to-end sequence is never laid out in the body as one workflow — it is delegated to an external skill that may not be installed.

4 / 5

Progressive Disclosure

Three one-level-deep references (overview.md, setup.md, verification.md) are clearly signaled with per-file descriptions, all verified present, and bulk content is correctly split out. However, the body points to examples/express/, examples/nextjs/, and examples/fastapi/ for 'complete handlers with tests', and none of these directories exist in the bundle — broken navigation paths.

4 / 5

Total

16

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete, comprehensive actions paired with an explicit 'Use when' clause rich in domain-specific trigger terms. Its only weakness is a handful of missing natural phrasing variations users might use.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Receive and verify AgentMail webhooks', 'debugging Svix signature verification', 'deduplicating on event_id' — with specifics down to header names (svix-id, svix-timestamp, svix-signature), the whsec_ secret prefix, and a dozen event names, giving comprehensive coverage of the skill's surface.

5 / 5

Completeness

Explicitly answers both: 'what' via 'Receive and verify AgentMail webhooks (email inboxes for AI agents)' and 'when' via an explicit 'Use when setting up... debugging... deduplicating... or handling events like...' clause with concrete trigger phrases — a textbook match for the top anchor.

5 / 5

Trigger Term Quality

Natural terms a user would say are well covered ('AgentMail webhooks', 'webhook handlers', 'signature verification', 'message.received', 'domain.verified'), but a few plausible phrasings like 'duplicate events' or 'email arrives in the inbox' are missing, keeping it just below the comprehensive anchor.

4 / 5

Distinctiveness Conflict Risk

The description is anchored to a clear niche — AgentMail specifically, with Svix and its exact headers/secret format named — so it is unlikely to trigger for any other webhook skill.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 3 missing

Warning

Total

15

/

16

Passed

Repository

hookdeck/webhook-skills

Path

skills/agentmail-webhooks/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.