Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add drmhse/authos_skill --skill authos-webhook-integrationgit clone --depth 1 https://github.com/drmhse/authos_skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/drmhse/authos_skill/authos-webhook-integration)<a href="https://agentmods.dev/skills/drmhse/authos_skill/authos-webhook-integration"><img src="https://agentmods.dev/badge/skills/drmhse/authos_skill/authos-webhook-integration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/drmhse/authos_skill/authos-webhook-integration"><img src="https://agentmods.dev/badge/skills/drmhse/authos_skill/authos-webhook-integration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00994 |
| Opus 5.5 | $0.00020 | $0.00398 |
| Sonnet 5.5 | $0.00010 | $0.00199 |
| Haiku 4.5 | $0.00005 | $0.00099 |
Grade A, and why
authos-webhook-integration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AuthOS Webhook Integration
Public AuthOS Links
Use these public AuthOS links when producing user-facing setup or troubleshooting guidance:
- Main site: https://authos.dev/
- Documentation: https://authos.dev/docs/
- AI Agent Skills guide: https://authos.dev/docs/ai-agent-skills/
- AuthOS source repository: https://github.com/drmhse/AuthOS
Use this skill for webhooks emitted by AuthOS tenant events. Billing provider webhooks such as /webhooks/stripe and /webhooks/billing are inbound provider callbacks to AuthOS and are not tenant event webhooks.
Management APIs
POST/GET /api/organizations/:org_slug/webhooksGET/PATCH/DELETE /api/organizations/:org_slug/webhooks/:webhook_idGET /api/organizations/:org_slug/webhooks/:webhook_id/deliveriesPOST /api/organizations/:org_slug/webhooks/:webhook_id/testGET /api/organizations/:org_slug/webhooks/event-types
Create a webhook:
{
"name": "Production sync",
"url": "https://app.example.com/webhooks/authos",
"events": ["user.signup.success", "user.login.success"]
}
AuthOS returns the signing secret on creation. Store it immediately.
Current Event Types
The current event allowlist includes:
user.signup.success
user.login.success
user.login.failed
user.logout
user.mfa.enabled
user.mfa.disabled
user.mfa.verify.success
user.mfa.verify.failed
user.invited
user.joined
user.removed
user.role_updated
service.created
service.updated
service.deleted
service.oauth_credentials.updated
organization.updated
organization.smtp.configured
organization.smtp.removed
plan.created
plan.updated
plan.deleted
subscription.created
subscription.updated
subscription.canceled
invitation.accepted
invitation.declined
invitation.expired
invitation.revoked
security.mfa.enabled
security.mfa.disabled
security.password.changed
api_key.created
api_key.deleted
domain.set
domain.verified
domain.deleted
branding.updated
Source also has internal event variants for siem_config.*, but the public webhook management allowlist currently omits them. Do not advertise them as subscribable unless the allowlist changes.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 137 lines · 51 tokens per session scan A e0fcf9120b79
authos-webhook-integration is a skill published in the GitHub repository drmhse/authos_skill (2 stars, last pushed 4mo ago), licensed MIT. It adds 51 tokens to every session and 994 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
creating-springboot-projects
Use when starting a new Spring Boot project or service: scaffolding or bootstrapping a backend, REST API, microservice or modular monolith; choosing how to structure it (layered, package-by-module, modular monolith, tomato, DDD-hexagonal); selecting Spring Boot 4 features; generating the base project with progen or…
springboot-migration
Use when upgrading an existing Spring Boot application, for example from Boot 3.x to Boot 4 or to the latest Spring Boot and Java: dependency transitions and starter renames, test annotations such as @MockBean to @MockitoBean, Jackson 3 issues, Spring Modulith 2 or Testcontainers 2 upgrades, code that stops compiling…
writing-springboot-tests
Use when writing or adding tests for Spring Boot code at a service's edges: HTTP clients that call other services (WireMock: 4xx and 5xx responses, timeouts, retries), Kafka or RabbitMQ listeners (redelivery, poison messages, dead-letter topics), events published to other services, or full-API tests against real…
add-module
Adds a new application module to this Spring Modulith project with the package layout the ModuleBoundariesTests gate expects, and a module-scoped integration test. Use when the user asks for a new module, bounded context, or feature area that doesn't belong in an existing module.
custom-post-type-architect
Use when the user asks to create a custom post type, build a portfolio, set up case studies, add team members, events, or podcast episodes, or says 'scaffold a CPT'. Creates the post type plus supporting taxonomies, an ACF field group, sample entries, and a builder-specific single template suggestion.
architecture
Proactive architecture review — explore codebase structure, generate a self-contained HTML report with Mermaid diagrams and candidate improvements, then grill the findings. Use when planning a large refactor, onboarding to an unfamiliar codebase, or before a major architectural change.