CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/webhook-replay-tests

Tests inbound webhook receivers for replay-attack resistance: capture incoming webhook payloads + headers, replay against the receiver under test, validate the Standard Webhooks signature scheme (svix-id + svix-timestamp + svix-signature, HMAC-SHA256 over `{id}.{timestamp}.{payload}`), svix-id idempotency dedup, and 5-minute timestamp-window enforcement by signing fixtures at runtime. Does NOT cover outbound delivery, retry-on-5xx, or failure-event exhaustion - those belong to an outbound webhook delivery harness. Use when testing the receiving side of a webhook integration.

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured testing recipe with executable code and built-in validation at every step; the main weakness is mild verbosity from repeated spec-citation lead-ins and one undefined crypto helper.

Suggestions

Replace the repeated 'Per the [Standard Webhooks spec]' lead-ins in Steps 2, 5, 7, and 8 with a single reference near the top (or inline bracketed links) to tighten conciseness.

Define the compute_sig helper used in Step 8 (or derive it from sign_webhook) so the key-rotation example is copy-paste runnable without guessing.

Note explicitly that reset_orders_table/count_orders in Step 7 are caller-supplied test scaffolding so readers know they must provide their own state helpers.

DimensionReasoningScore

Conciseness

Largely lean and code-forward with no basic-concept bloat, but the 'Per the [Standard Webhooks spec]' lead-in is repeated verbatim across Steps 2, 5, 7, and 8 and could be tightened to a single anchored reference.

2 / 3

Actionability

Provides fully executable Python (sign_webhook, positive/negative/tamper/idempotency/sanitize tests) that is copy-paste ready; the only blemish is an undefined compute_sig helper in Step 8 alongside environment stubs like reset_orders_table/count_orders.

3 / 3

Workflow Clarity

A clearly sequenced 9-step workflow where each test step is itself an explicit assert-based validation checkpoint, supplemented by an Anti-patterns checklist providing corrective guidance.

3 / 3

Progressive Disclosure

Well-organized into labeled sections with only one-level-deep external references (spec URL and sister skills); no nested references and no bundle files to mis-signal, so the self-contained structure is appropriate for the scope.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names specific actions, supplies natural trigger terms, and gives an explicit 'Use when' clause while explicitly fencing off the outbound-delivery sister domain.

DimensionReasoningScore

Specificity

Lists multiple concrete actions (capture payloads+headers, replay, validate the svix signature scheme, svix-id idempotency dedup, 5-minute window enforcement, runtime fixture signing) rather than vague domain talk.

3 / 3

Completeness

Explicitly answers what it does (capture/replay/validate/dedup/window) and when to use it via the 'Use when testing the receiving side of a webhook integration' trigger clause.

3 / 3

Trigger Term Quality

Covers natural terms a tester would actually say (webhook, replay-attack, inbound webhook receivers, signature, idempotency, timestamp window) reinforced by metadata keywords.

3 / 3

Distinctiveness Conflict Risk

Carves a clear niche (inbound receiving side) and explicitly excludes outbound delivery, retry-on-5xx, and failure-event exhaustion as belonging to a separate delivery harness, minimizing overlap.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents