CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/webhook-delivery-tester

The single webhook-testing home, sender AND receiver: build-an-X for webhook delivery + receiver tests per Standard Webhooks (standardwebhooks.com) - HMAC-SHA256 signature verification, retry semantics with exponential backoff + jitter, replay-window check via timestamp tolerance, ordering guarantees, dead-letter handling for permanent failures, content-type + body-encoding fidelity - plus inbound capture-and-replay hardening (runtime-signed fixtures, tampered-payload and future-timestamp rejection, key-rotation acceptance, sanitized production captures) in references/inbound-replay.md. Use when authoring tests for webhook senders OR receivers in any system (Stripe / Twilio / SendGrid / GitHub / GitLab outbound webhooks; SaaS app inbound webhooks), including payment and realtime integrations.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable skill body with executable test examples, clear sequencing, a recap checklist, and clean one-level-deep references. Only minor conciseness nitpicks around the redundant checklist recap.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's competence - it does not explain HMAC, webhooks, or backoff - but Step 9's checklist largely recaps Steps 1-8 and the 'When to use' section repeats the description, minor padding that could be trimmed without loss.

4 / 5

Actionability

Provides multiple copy-paste-ready, fully-defined functions (sign_webhook, test_receiver_rejects_invalid_signature, test_webhook_retries_on_5xx, test_handler_handles_out_of_order_events) covering the common sender and receiver cases; only lightweight test fixtures (capture_outbound_webhook, mock_receiver) are left to the environment.

5 / 5

Workflow Clarity

Steps are clearly sequenced sender-then-receiver with a consolidated checklist (Step 9) and explicit validation checkpoints ('If receiver doesn't enforce this, mark critical', 'If your handler can't survive out-of-order, mark critical') that flag risky gaps.

5 / 5

Progressive Disclosure

SKILL.md is an overview that offloads the deeper attack cases to one-level-deep, clearly signaled links - references/inbound-replay.md and references/vendor-payloads-and-retries.md - both of which exist as real files; navigation is easy and nothing is nested beyond one level.

5 / 5

Total

19

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, highly specific description that explicitly covers what the skill does and when to invoke it, with concrete vendor triggers. Slightly verbose and a touch jargon-heavy in places, but well above the bar.

DimensionReasoningScore

Specificity

Lists many concrete actions - 'HMAC-SHA256 signature verification, retry semantics with exponential backoff + jitter, replay-window check via timestamp tolerance, ordering guarantees, dead-letter handling ... content-type + body-encoding fidelity' plus 'tampered-payload and future-timestamp rejection, key-rotation acceptance, sanitized production captures' - matching the comprehensive-coverage anchor.

5 / 5

Completeness

Explicitly answers both: what ('build-an-X for webhook delivery + receiver tests ...') and when ('Use when authoring tests for webhook senders OR receivers in any system (Stripe / Twilio / SendGrid / GitHub / GitLab outbound webhooks; SaaS app inbound webhooks), including payment and realtime integrations.'), with concrete trigger phrases.

5 / 5

Trigger Term Quality

Good natural keyword coverage - 'webhook', 'Standard Webhooks', 'Stripe / Twilio / SendGrid / GitHub / GitLab outbound webhooks', 'payment and realtime integrations' - but phrases like 'build-an-X' and 'replay-window check via timestamp tolerance' lean technical, and common synonyms like 'callback' or 'event delivery' are absent, so it sits below the comprehensive anchor.

4 / 5

Distinctiveness Conflict Risk

Clear niche (webhook sender + receiver test authoring) with vendor-specific triggers and a narrow domain, so it is unlikely to fire for an unrelated skill; the cross-plugin companions live in the body, not the description.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents