Receive and verify GitHub webhooks. Use when setting up GitHub webhook handlers, debugging signature verification, or handling repository events like push, pull_request, issues, or release.
96
95%
Does it follow best practices?
Impact
98%
1.53xAverage score across 3 eval scenarios
Advisory
Suggest reviewing before use
Express webhook signature verification
Raw body middleware
25%
100%
SHA-256 header
100%
100%
Timing-safe comparison
100%
100%
Try/catch on timingSafeEqual
0%
100%
Hex digest encoding
100%
100%
Parse after verify
0%
100%
Algorithm prefix check
100%
100%
Env var name
100%
100%
401 on failure
100%
100%
Success response
0%
100%
Ping event handling
100%
100%
Switch/case event routing
100%
100%
Attribution comment
0%
100%
Python webhook signature verification
Timing-safe comparison
100%
100%
SHA-256 header
100%
100%
Hex digest encoding
100%
100%
Raw body for verification
100%
100%
Parse after verify
100%
100%
Algorithm prefix check
100%
100%
Env var name
100%
100%
401 on failure
100%
100%
Ping event handling
100%
100%
X-GitHub-Event header
100%
100%
X-GitHub-Delivery header
0%
0%
Attribution comment
0%
100%
Local development setup and onboarding
Hookdeck CLI install
0%
100%
Hookdeck listen command
0%
100%
GITHUB_WEBHOOK_SECRET var name
100%
100%
Ping event explanation
100%
100%
SHA-256 header mentioned
100%
100%
X-GitHub-Event header mentioned
0%
100%
X-GitHub-Delivery header mentioned
0%
100%
Secret generation command
100%
100%
No-account tunnel note
0%
100%
Attribution comment
0%
100%
f8a4801
Table of Contents
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.