CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

deck-webhooks

Receive and verify Deck (deck.co) webhooks, the event stream for Deck's computer-use agents API (agents, sources, Deck Vault credentials, sessions, tasks, task runs, workflows, storage). Use when setting up a Deck webhook event destination, generating the caller-provided whsec_ signing secret, debugging Standard Webhooks signature verification (webhook-id, webhook-timestamp, webhook-signature), rotating secrets, or handling events like task_run.completed, task_run.failed, task_run.interaction_required (MFA prompts), credential.verified, credential.invalid, workflow_run.completed, storage.created and test.ping.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong reference-style skill body: nearly everything shown is executable and Deck-specific, verification includes genuine fail-closed error handling, and progressive disclosure mostly offloads bulk detail to three well-signaled reference files. The main costs are a padded tail of cross-promotional link sections, an implicit rather than explicit end-to-end workflow, and references to examples/ directories that are absent from the bundle.

Suggestions

Trim the 'Related Skills' list (12 external links), the 'Recommended' section, and the 'Attribution' section to a few lines or move them to a reference file — roughly 20 lines of the body are cross-promotion rather than skill content.

Add a short numbered setup workflow (generate secret → create destination → return 2xx to activate → verify deliveries) with the pending_verification checkpoint inline, instead of leaving the sequence implicit across topic sections and in references/setup.md.

Either include the examples/express, examples/nextjs, and examples/fastapi handler directories in the bundle or remove/replace those links with pointers to content that exists (e.g., a complete handler in references/verification.md).

DimensionReasoningScore

Conciseness

The instructional core is lean and assumes competence — no "what is a webhook" padding, and sections like Verification and Delivery Semantics carry only Deck-specific facts ("5-minute timestamp tolerance", "previous one valid 24h after rotation", "base 2, starting at 30s"). However, the trailing "Related Skills" section (12 external skill links), the "Recommended: webhook-handler-patterns" section with 4 more links, and the "Attribution" section are tokens that don't serve the skill's task. Not 3: this is link-list padding rather than unnecessary explanation, and the actual guidance is trim; not 5: those trailing sections keep it from "every token earns its place".

4 / 5

Actionability

Fully executable, copy-paste-ready guidance covering the common cases: a node one-liner to generate the secret, a complete curl call to create the destination, a working fail-closed JavaScript verifier with dual-secret rotation handling and explicit 400/500 outcomes, the Python equivalent, the interaction-answer endpoint ("POST /v2/task-runs/{data.id}/interaction"), the failure-inspection endpoint, and a hookdeck CLI command. Matches the score-5 anchor; a 4 would require minor gaps, and none of the shown code is pseudocode or incomplete.

5 / 5

Workflow Clarity

The setup-to-handling flow is clear in section order (generate secret → create destination → 2xx activates it → verify each delivery → handle idempotently), and verification has real checkpoints ("fail closed → 500", "→ 400 Invalid signature", try both secrets then rethrow the last error). Not 5: the body never presents this as an explicit sequenced workflow with validation feedback loops — the numbered steps live in references/setup.md, and the reader must assemble the sequence across topic sections. Not 3: the checkpoints that are present (activation via 2xx, fail-closed behavior, failure inspection via GET /event-deliveries?status=failure, dedupe guidance) are explicit, not implicit.

4 / 5

Progressive Disclosure

Good structure against the actual bundle: the three real reference files (references/overview.md, setup.md, verification.md) are each linked inline where relevant and listed with one-line descriptions in a Reference Materials section, one level deep, and bulk detail (full event catalog, manual verification) is correctly kept out of SKILL.md. Not 5: the body points to "examples/express/", "examples/nextjs/", and "examples/fastapi/" for complete handlers, but no examples/ directory exists in the bundle — dangling paths that break easy navigation. Not 3: references are clearly signaled and content is appropriately split, well above the 'buried references' anchor.

4 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An excellent description: it concisely states what the skill does, defines the domain (Deck's computer-use agents event stream), and provides an explicit "Use when" clause packed with concrete, natural trigger phrases covering setup, secret generation, signature debugging, rotation, and specific event types. It is third-person, dense with specifics, and free of fluff or over-claims.

DimensionReasoningScore

Specificity

Lists multiple specific concrete actions with comprehensive coverage: "Receive and verify Deck (deck.co) webhooks", "setting up a Deck webhook event destination", "generating the caller-provided whsec_ signing secret", "debugging Standard Webhooks signature verification", "rotating secrets", and "handling events like task_run.completed ... credential.invalid ... test.ping". This matches the score-5 anchor (multiple specific concrete actions, comprehensive) rather than 4, which requires minor gaps in coverage — setup, verification, rotation, debugging, and event handling are all explicitly named.

5 / 5

Completeness

Clearly answers both questions: the "what" is "Receive and verify Deck (deck.co) webhooks, the event stream for Deck's computer-use agents API (agents, sources, Deck Vault credentials, sessions, tasks, task runs, workflows, storage)" and the "when" is an explicit "Use when setting up a Deck webhook event destination, generating ... rotating secrets, or handling events" clause with concrete triggers. Matches the score-5 anchor exactly; a 4 would require the 'when' to be less explicit or specific.

5 / 5

Trigger Term Quality

Natural terms a user would say are comprehensively covered with synonyms: "Deck webhooks", "deck.co", "signing secret", "whsec_", "signature verification", "webhook-id, webhook-timestamp, webhook-signature", "rotating secrets", "MFA prompts", and concrete event names (task_run.completed, credential.invalid, test.ping). Not 4: no natural phrasing for this domain is meaningfully missing — debugging, rotation, and event-handling vocabulary plus synonyms are all present.

5 / 5

Distinctiveness Conflict Risk

Clear niche with distinct triggers: every trigger is scoped to the specific provider "Deck (deck.co)" and its event names, so it will not fire for generic webhook, PDF, or other provider questions. The only shared vocabulary is "Standard Webhooks", but a user needing the svix or generic implementation would not say "Deck" — minimal conflict risk per the score-5 anchor.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 3 missing

Warning

Total

15

/

16

Passed

Repository

hookdeck/webhook-skills

Path

skills/deck-webhooks/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.