agentsclimarketplace

Webhook receiver

Skill baronguyen001/ai-automation-skills/skills/webhook-receiver

8 production-tested Claude skills: automation, Gemini cost/structured output, OSS bounty scouting, ML validation.

Install
npx -y skills add baronguyen001/ai-automation-skills --skill webhook-receiver

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Receive inbound webhooks with no web framework - a tiny stdlib HTTP server that verifies an HMAC signature in constant time and queues each payload to disk for a worker to process. Use for receive a webhook, handle an incoming POST, trigger a script from a webhook, verify a webhook signature, or stripe/github/telegram webhook intake.

SKILL.md

2.5 KB, 479 tokens by cl100k_base, as published. Nobody here has run it

Webhook Receiver

Use this skill when an external service must trigger your script by POSTing to a URL, and you want to authenticate and durably capture deliveries without pulling in Flask/FastAPI. It is an http.server receiver that rejects unsigned requests and writes each verified payload to a queue directory, so a slow downstream job never blocks or drops an event.

When to invoke

  • User says: "receive a webhook", "handle an incoming POST", "trigger my script when X happens", "verify the webhook signature".
  • Code in the conversation needs to ingest events from Stripe/GitHub/Telegram/a SaaS without a heavy web stack.

When NOT to invoke

  • The project already runs a web framework (Flask/FastAPI/Django) - add a route there instead.
  • The provider supports polling and you do not control a public URL; use a scheduled pull (see [[cron-dispatch]]).

Concrete example

User input:

Stripe needs to POST events to my box and run reconcile.py. Authenticate it and don't lose events.

Output:

export WEBHOOK_SECRET="whsec_..."         # shared secret from the provider
export WEBHOOK_QUEUE="events"             # one JSON file per delivery
python assets/receiver.py                 # listens on :8080, 401s bad signatures

# reconcile.py drains ./events on a timer (see cron-dispatch) - decoupled from intake

Pattern to apply

  1. Read the shared secret only from the environment; never hardcode it.
  2. Compute HMAC-SHA256 over the raw body and compare in constant time (hmac.compare_digest) - reject mismatches with 401.
  3. Cap the body size and require valid JSON before accepting, so a bad caller cannot exhaust memory.
  4. Persist the payload to a queue directory and return 202 immediately; let a separate worker process it.
  5. Keep intake and processing decoupled so a slow or crashed worker never drops a delivery.

Reference: assets/receiver.py.

Source

Distilled from production use across the author's automation projects. v1.0.0. See also: [[sqlite-state]], [[cron-dispatch]], [[pipeline-orchestrator]].

→ Build the full runnable bot with Trawlkit.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.