Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/hookdeck/webhook-skills/fireflies-webhooksnpx skills add hookdeck/webhook-skills --skill fireflies-webhooksgit clone --depth 1 https://github.com/hookdeck/webhook-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hookdeck/webhook-skills/fireflies-webhooks)<a href="https://agentmods.dev/skills/hookdeck/webhook-skills/fireflies-webhooks"><img src="https://agentmods.dev/badge/skills/hookdeck/webhook-skills/fireflies-webhooks.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00064 | $0.02992 |
| Opus 5 | $0.00032 | $0.01496 |
| Sonnet 5 | $0.00013 | $0.00598 |
| Haiku 4.5 | $0.00006 | $0.00299 |
Grade A, and why
fireflies-webhooks scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 263 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Fireflies Webhooks
This skill targets Webhooks V2, the current scheme. Fireflies steers new webhook creation to V2 and marks the V1 configuration page as deprecated, so build new integrations against V2. V1 still works for integrations already on it and is documented as a legacy path below.
When to Use This Skill
- Setting up Fireflies.ai webhook handlers (Webhooks V2)
- Debugging Fireflies signature verification failures
- Understanding the
X-Hub-Signatureheader and itssha256=prefix - Handling
meeting.transcribed,meeting.summarized, ormeeting.bot_joined - Reacting to
meeting_id/client_reference_idfrom anuploadAudioupload - Migrating an existing V1 handler to V2
Which Version Am I On?
The two fastest tells are the sha256= prefix on the signature header and
the payload field casing — V2 is snake_case, V1 is camelCase:
| V2 (this skill's default) | V1 (legacy) | |
|---|---|---|
| Header value | sha256=<hex> — prefixed |
bare hex digest, no prefix |
| Signature header | X-Hub-Signature |
x-hub-signature |
| Event field | event |
eventType |
| Event names | meeting.transcribed, meeting.summarized, meeting.bot_joined |
Transcription completed |
| Meeting ID field | meeting_id |
meetingId |
| Reference field | client_reference_id |
clientReferenceId |
| Timestamp field | timestamp (unix ms) |
not sent |
| Signing secret | optional — no header sent when unset | required, 16–32 chars |
| Event selection | subscribe per webhook | none (single event) |
| Configured at | Webhooks V2 configuration page | Settings > Developer Settings |
| Response deadline | 2xx within 10s | not documented |
Header names are case-insensitive, so read them lowercased in both versions. If
the header value starts with sha256=, you are on V2.
Verification (core)
Fireflies V2 signs the raw request body with HMAC-SHA256 keyed on the
signing secret you configured at webhook setup. The digest is hex-encoded,
prefixed with sha256=, and sent in the X-Hub-Signature header. Compare with
a timing-safe function. The docs state the raw body is what is signed, so there
is no ambiguity here (unlike V1 — see the hedge in the legacy section).
What ships with it
19 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- examples/express/.env.example 247 B
- examples/express/package.json 374 B
- examples/express/README.md 2.1 KB
- examples/express/src/index.js 4.5 KB runs code
- examples/express/test/webhook.test.js 8.3 KB runs code
- examples/fastapi/.env.example 247 B
- examples/fastapi/main.py 4.1 KB runs code
- examples/fastapi/README.md 2.0 KB
- examples/fastapi/requirements.txt 82 B
- examples/fastapi/test_webhook.py 8.7 KB runs code
- examples/nextjs/.env.example 247 B
- examples/nextjs/app/webhooks/fireflies/route.ts 3.7 KB runs code
- examples/nextjs/package.json 486 B
- examples/nextjs/README.md 1.8 KB
- examples/nextjs/test/webhook.test.ts 8.1 KB runs code
- examples/nextjs/vitest.config.ts 140 B runs code
- references/overview.md 6.1 KB
- references/setup.md 5.0 KB
- references/verification.md 14 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 263 lines · 64 tokens per session scan A da8d744f75f2
fireflies-webhooks is a skill published in the GitHub repository hookdeck/webhook-skills (84 stars, last pushed today), licensed MIT. It adds 64 tokens to every session and 2,992 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…