Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hookdeck/webhook-skills --skill mollie-webhooksgit clone --depth 1 https://github.com/hookdeck/webhook-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hookdeck/webhook-skills/mollie-webhooks)<a href="https://agentmods.dev/skills/hookdeck/webhook-skills/mollie-webhooks"><img src="https://agentmods.dev/badge/skills/hookdeck/webhook-skills/mollie-webhooks/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hookdeck/webhook-skills/mollie-webhooks"><img src="https://agentmods.dev/badge/skills/hookdeck/webhook-skills/mollie-webhooks.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 78 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium MCP Rug Pull · line 125 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.03219 |
| Opus 5.5 | $0.00039 | $0.01288 |
| Sonnet 5.5 | $0.00020 | $0.00644 |
| Haiku 4.5 | $0.00010 | $0.00322 |
Grade A, and why
mollie-webhooks scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mollie Webhooks
When to Use This Skill
- Setting up a Mollie webhook handler (classic
webhookUrlor next-gen subscription) - Verifying the
X-Mollie-Signatureheader on next-gen webhooks - Understanding why classic Mollie webhooks have no signature to verify
- How do I confirm a Mollie payment status from a classic webhook?
- Handling payment status changes:
paid,authorized,canceled,expired,failed - Why does my Mollie webhook only contain an
id?
Two Webhook Systems (Read This First)
Mollie runs two webhook systems side by side. They are secured differently, so work out which one you are receiving before writing a handler.
| Classic webhooks | Next-gen webhooks | |
|---|---|---|
| Configured by | webhookUrl passed when creating a payment (or order, subscription, payment link) |
A subscription created in the Dashboard (Developers → Webhooks) or POST /v2/webhooks, with a list of eventTypes |
| Body | application/x-www-form-urlencoded, a single id=tr_… |
JSON event object (resource: "event", id, type, entityId, createdAt, _links, optional _embedded.entity snapshot) |
| Signed? | No | Yes: X-Mollie-Signature: sha256=<hex HMAC-SHA256 of the raw body> |
| Security model | Fetch-to-confirm: fetch the payment with your API key | Verify the signature with the webhook's signing secret |
Mollie's guidance: "If your system needs to support both webhook styles,
differentiate between payments webhooks webcalls and new calls (new Webhooks
send a new header X-Mollie-Signature...)", and "we recommend using separate
URLs (one for each webhooks system)". The examples use /webhooks/mollie for
classic and /webhooks/mollie/events for next-gen.
Classic Webhooks: Fetch to Confirm
Classic webhooks are not signed: no HMAC, no signature header, no shared
secret. Mollie sends a POST with a single application/x-www-form-urlencoded
body parameter:
id=tr_5B8cwPMGnU6qLbRvo7qEZo
The status is deliberately not in the payload. You must not trust the
request body: anyone could POST a fake id. Instead you fetch the resource
from the Mollie API using your API key and read the authoritative status. This
is the fetch-to-confirm pattern, and it is the security model: a forged
webhook can only ever cause you to re-fetch a real payment you own.
What ships with it
21 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- examples/express/.env.example 515 B
- examples/express/package.json 437 B
- examples/express/README.md 3.7 KB
- examples/express/src/index.js 7.1 KB runs code
- examples/express/test/webhook.test.js 6.6 KB runs code
- examples/fastapi/.env.example 504 B
- examples/fastapi/main.py 6.9 KB runs code
- examples/fastapi/README.md 3.8 KB
- examples/fastapi/requirements.txt 119 B
- examples/fastapi/test_webhook.py 6.8 KB runs code
- examples/nextjs/.env.example 504 B
- examples/nextjs/app/webhooks/mollie/events/route.ts 3.2 KB runs code
- examples/nextjs/app/webhooks/mollie/route.ts 3.0 KB runs code
- examples/nextjs/package.json 559 B
- examples/nextjs/README.md 3.5 KB
- examples/nextjs/test/events.test.ts 4.0 KB runs code
- examples/nextjs/test/webhook.test.ts 2.6 KB runs code
- examples/nextjs/vitest.config.ts 140 B runs code
- references/overview.md 6.1 KB
- references/setup.md 4.9 KB
- references/verification.md 8.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 29d ago Changed · +99 lines · +16 tokens per session b866082b6d78
- 2mo ago First seen · 165 lines · 82 tokens per session scan A dc52453c8187
mollie-webhooks is a skill published in the GitHub repository hookdeck/webhook-skills (98 stars, last pushed yesterday), licensed MIT. It adds 98 tokens to every session and 3,219 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
mollie-webhooks compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| mollie-webhookshookdeck/webhook-skills | Skill | 98 | yesterday | MIT | A | 98 | Claude Code, Codex |
| imagegenopenai/codex | Skill | 133k | yesterday | Apache-2.0 | A | 113 | Codex |
| playwright-climicrosoft/playwright | Skill | 99k | yesterday | Apache-2.0 | A | 19 | Claude Code |
| local-ai-agentsmicrosoft/ai-agents-for-beginners | Skill | 79k | 4d ago | MIT | A | 200 | Claude Code, Codex |
| systematic-debuggingobra/superpowers | Skill | 313k | 3d ago | MIT | A | 21 | Claude Code |
| next-cache-components-adoptionvercel/next.js | Skill | 143k | yesterday | MIT | A | 95 | Claude Code |
| next-partial-prefetching-adoptionvercel/next.js | Skill | 143k | yesterday | MIT | A | 103 | Claude Code |