Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/khadinakbarlabs/shopify-app-builder/add-webhookgit clone --depth 1 https://github.com/khadinakbarlabs/shopify-app-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/khadinakbarlabs/shopify-app-builder/add-webhook)<a href="https://agentmods.dev/commands/khadinakbarlabs/shopify-app-builder/add-webhook"><img src="https://agentmods.dev/badge/commands/khadinakbarlabs/shopify-app-builder/add-webhook.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.00549 |
| Opus 5 | $0.00010 | $0.00275 |
| Sonnet 5 | $0.00004 | $0.00110 |
| Haiku 4.5 | $0.00002 | $0.00055 |
Grade A, and why
add-webhook scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Add Webhook Subscription
You are adding event-driven integrations to a Shopify app. Configure webhooks with proper signature verification and handler patterns.
Topic Selection and Registration
-
Define webhook topic
- Select from supported topics: ORDERS_PAID, PRODUCTS_CREATE, INVENTORY_LEVELS_UPDATE, CUSTOMER_CREATED, FULFILLMENT_EVENTS_CREATE
- Add to shopify.app.toml under webhooks section with
topic: [TOPIC_NAME] - Confirm compatibility with the latest supported stable API version
- Reference skill: webhook topics (02_apis.md)
-
Configure webhook endpoint
- Create handler at
/routes/webhooks/[webhook-topic].jsx - Endpoint receives POST requests from Shopify infrastructure
- Ensure endpoint returns 200 OK within 5 seconds (async processing recommended)
- Reference skill: webhook architecture (01_cli_scaffolding.md)
- Create handler at
Handler Implementation
-
Implement signature verification
- Extract X-Shopify-Hmac-SHA256 header from request
- Compute HMAC-SHA256 using raw request body + SHOPIFY_API_SECRET
- Compare computed vs provided HMAC (constant-time comparison)
- Reject if signatures don't match (security critical)
- Reference skill: webhook security (02_apis.md)
-
Process webhook payload
- Parse JSON body from webhook request
- Extract relevant fields from event object (e.g., orderId, productId)
- Route to business logic handlers based on webhook topic
- Log processed event with timestamp and status
- Reference skill: event processing patterns (01_cli_scaffolding.md)
-
Handle async operations
- Queue long-running tasks (API calls, data syncs) to job processor
- Return 200 immediately; process details asynchronously
- Implement retry logic for failed webhook processing (exponential backoff)
- Store webhook state in database for idempotency
Testing and Deployment
- Test webhook delivery
- Use Shopify admin "Test event" button for registered topics
- Verify handler receives payload and returns 200
- Confirm log entries show successful processing
- Check database for expected side effects
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 64 lines · 19 tokens per session scan A 8fc0fb008481
add-webhook is a command published in the GitHub repository khadinakbarlabs/shopify-app-builder (1 stars, last pushed 27d ago), licensed MIT. It adds 19 tokens to every session and 549 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
tray-referencia-api
Referência rápida de todos os endpoints da API da Tray, aceita nome do recurso como filtro.
tray-setup
Guia rápido para configuração inicial de integração com a API da Tray.
tray-validar-integracao
Valida o código de integração com a Tray verificando problemas comuns e boas práticas.
init
Initialize configurations for Supabase local development.
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.