CtrlK
BlogDocsLog inGet started
Tessl Logo

alipay-webhooks

Receive and verify Alipay (Antom / Alipay+) webhook notifications. Use when setting up Alipay webhook handlers, debugging RSA256 Signature header verification, or handling payment events like notifyPayment, notifyCapture, notifyRefund, notifyAuthorization, and notifyDispute.

71

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers high-value, provider-specific executable guidance with a clear workflow and well-organized one-level-deep references, but is held back from full marks by minor padding in the link sections, an implicit verify-then-ack validation gate, and examples/ relative links that do not resolve in the local bundle.

Suggestions

Add an explicit validation gate in the workflow — e.g. 'Only return HTTP 200 with the success body after verifyAlipay() returns true; on false, respond non-200 so Antom retries and log the failure' — to close the workflow_clarity gap.

Make the ack-signing path self-contained: inline a minimal signAck() snippet (or load-public-key step) instead of deferring entirely to 'see the examples', since the examples/ directories are not present in the bundle.

Trim or relocate the 10-entry Related Skills list and the webhook-handler-patterns link block into a single concise pointer to reduce conciseness padding while preserving navigation.

DimensionReasoningScore

Conciseness

The body is dense with provider-specific knowledge Claude does not already know (two-line signed content, base64URL+percent-encoding, retry schedule), but the 10-entry Related Skills list and the multi-link webhook-handler-patterns block add length that could be trimmed, fitting the 4-anchor 'efficient; minor instances…that could be trimmed'; not 5 because of that padding, not 3 because core content is genuinely novel rather than over-explained.

4 / 5

Actionability

Provides mostly executable guidance — full verifyAlipay/parseSignatureHeader JS, the ack JSON body, env vars, and a tunnel command — with minor gaps: ack signing is deferred to 'see the examples', public-key PEM loading is not shown, and examples/express relative links have no matching local bundle, matching the 4-anchor; not 5 because of those gaps, not 3 because the core verify path is real executable code rather than pseudocode.

4 / 5

Workflow Clarity

A clear receive→verify→handle→ack sequence is present with a numbered list of the three signature trip-ups and an idempotency/retry note, but there is no explicit 'only return HTTP 200 after verification passes' validation gate, fitting the 4-anchor 'clear sequence with most checkpoints present; minor validation gaps'; not 5 because the verify-then-ack checkpoint is implicit, not 3 because the sequence and key checkpoints are clearly laid out.

4 / 5

Progressive Disclosure

SKILL.md is an overview pointing to three real, clearly-signaled one-level-deep files in references/ (overview.md, setup.md, verification.md — all verified present), but the examples/express, examples/nextjs, examples/fastapi relative links have no corresponding local bundle directory, fitting the 4-anchor 'good structure…minor organization gaps'; not 5 because of the unresolved examples/ links, not 3 because references are well-signaled and one level deep rather than buried.

4 / 5

Total

16

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it states concrete capabilities, includes a explicit 'Use when' clause with concrete trigger phrases, covers natural synonyms (Antom/Alipay+), and carves out a distinct niche from sibling payment-webhook skills. Third-person voice is used correctly with no over-claims or fluff.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Receive and verify…webhook notifications', 'setting up Alipay webhook handlers', 'debugging RSA256 Signature header verification', 'handling payment events like notifyPayment, notifyCapture, notifyRefund…' — with comprehensive coverage of the domain, matching the score-5 anchor; no anchor above exists and it is well clear of the 4-anchor's 'minor gaps'.

5 / 5

Completeness

Explicitly answers both 'what' ('Receive and verify Alipay (Antom / Alipay+) webhook notifications') and 'when' via a concrete 'Use when setting up…debugging…or handling payment events like…' clause, matching the 5-anchor; clearly above the 4-anchor whose 'when' is only 'could be more explicit'.

5 / 5

Trigger Term Quality

Covers natural terms users say — 'Alipay', 'Antom / Alipay+' as product synonyms, 'webhook notifications', 'webhook handlers', 'RSA256 Signature header verification', and the named notify* events — comprehensively including synonyms, matching the 5-anchor; not the 4-anchor because coverage is thorough rather than missing 'a few natural terms'.

5 / 5

Distinctiveness Conflict Risk

Targets a clear niche — Alipay/Antom/Alipay+ header-based RSA256 webhook verification — with distinct triggers unlikely to fire for sibling payment skills, matching the 5-anchor; above the 4-anchor because conflict risk is minimal, not merely 'mostly distinct'.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 3 missing

Warning

Total

15

/

16

Passed

Repository
hookdeck/webhook-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.