CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

creating-webhook-handlers

Create webhook endpoints with signature verification, retry logic, and payload validation. Use when receiving and processing webhook events. Trigger with phrases like "create webhook", "handle webhook events", or "setup webhook handler".

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured skill body: a lean, actionable overview that assumes Claude's competence, a clearly sequenced workflow with explicit validation and error-recovery feedback loops, and properly progressive disclosure to three real, one-level-deep reference files. The only minor improvements are trimming the generic Resources links and specifying timing-safe signature comparison and retry/backoff parameters.

DimensionReasoningScore

Conciseness

Dense and instructional — it assumes Claude's competence (no explanation of what webhooks or HMAC are) and every section carries operational content. The Resources section (RFC 2104 HMAC spec, generic OWASP link) is minor padding Claude doesn't need, keeping it just below the leanest anchor.

4 / 5

Actionability

Highly concrete guidance — exact signature headers (X-Hub-Signature-256, Stripe-Signature), a specific API call (stripe.webhooks.constructEvent()), exact response codes, and exact output file paths. Small gaps remain: the HMAC comparison doesn't mention timing-safe/constant-time comparison, and retry counts and backoff for dead-letter handling are unspecified.

4 / 5

Workflow Clarity

Eight clearly sequenced steps with an explicit validation checkpoint (step 8: replay tests with both valid and tampered signatures) and documented feedback loops for error recovery (the Error Handling table maps each failure mode to a concrete remedy). This is not a destructive operation, so no validation cap applies.

5 / 5

Progressive Disclosure

The body is a well-sectioned ~65-line overview with three one-level-deep references (implementation.md, errors.md, examples.md), each clearly signaled with a descriptive link describing what it contains, and all three files exist in the references/ bundle. Content is appropriately split between overview and detail.

5 / 5

Total

18

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that explicitly states concrete capabilities, includes an explicit 'Use when' clause with natural trigger phrases, and occupies a clearly distinct niche. The only weaknesses are minor: trigger synonym coverage is not exhaustive and the capability list omits idempotency and multi-provider support that the body delivers.

DimensionReasoningScore

Specificity

Lists several specific concrete actions — "signature verification, retry logic, and payload validation" — but omits capabilities the skill body emphasizes (idempotent processing, multi-provider support), leaving minor gaps in coverage.

4 / 5

Completeness

Clearly answers both what ("Create webhook endpoints with signature verification, retry logic, and payload validation") and when ("Use when receiving and processing webhook events"), with explicit concrete trigger phrases — matching the top anchor's structure.

5 / 5

Trigger Term Quality

Natural trigger phrases with good verb variation ("create webhook", "handle webhook events", "setup webhook handler") that users would actually say, but common synonyms like "webhook endpoint", "receive webhooks", or provider-specific terms ("Stripe webhook") are missing.

4 / 5

Distinctiveness Conflict Risk

"Webhook" is a distinctive niche keyword with dedicated triggers, giving minimal conflict risk; only minor overlap with closely related skills like generic API-endpoint creation or payment-integration skills keeps it below the top anchor.

4 / 5

Total

17

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

14

/

16

Passed

Repository

jeremylongshore/tons-of-skills-marketplace

Path

plugins/api-development/webhook-handler-creator/skills/creating-webhook-handlers/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.