Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/svix/ai/receiving-webhooksnpx skills add svix/ai --skill receiving-webhooksgit clone --depth 1 https://github.com/svix/aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/svix/ai/receiving-webhooks)<a href="https://agentmods.dev/skills/svix/ai/receiving-webhooks"><img src="https://agentmods.dev/badge/skills/svix/ai/receiving-webhooks.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00056 | $0.01552 |
| Opus 5 | $0.00028 | $0.00776 |
| Sonnet 5 | $0.00011 | $0.00310 |
| Haiku 4.5 | $0.00006 | $0.00155 |
Grade C, and why
receiving-webhooks scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
1. **Extract the secret bytes.** The signing secret is prefixed with `whsec_`; Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Replaying old captured payloads with curl.** Verification rejects stale How it starts
The opening of the file, as written. The whole thing — 146 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Receiving Webhooks
A webhook is just an HTTP POST from a source you don't control. Treat every request as untrusted until its signature is verified. These guidelines apply to any handler consuming webhooks, regardless of which provider or platform sends them.
Header names, secret formats, and tolerances vary by provider. The names below follow the Standard Webhooks specification; always confirm the exact header names, signing scheme, and replay window against your provider's documentation before writing code.
Standard Webhooks
Standard Webhooks is an open specification
plus reference libraries in most major languages for sending and verifying
webhooks securely and consistently. Instead of every provider inventing its own
header names and signing scheme, it defines a single, interoperable format.
When your provider supports it, prefer the official standardwebhooks library over hand-rolled
verification, it validates the signature, enforces the timestamp tolerance, and
guards against replay attacks for you. The examples below use it.
If your provider sends webhooks through Svix (the
svix-id, svix-timestamp, and svix-signature headers are the tell), use the
official Svix SDK instead.
The non-negotiables
- Verify the signature on every request. An unverified webhook is an anonymous internet POST. Anyone who learns your URL can forge events. Only act on payloads that pass verification.
- Verify against the raw request body. The signature is computed over the exact bytes sent. Any framework that parses JSON and re-stringifies it breaks verification. Read the unprocessed body.
- Return a
2xxwithin seconds. Anything else, including3xxredirects, is typically treated as a failure and retried. Push heavy work async.
Handler shape
- Read the raw body. Do not parse JSON before verification.
- Verify the signature using the provider's official library (or its
documented scheme), passing the signature headers and your signing secret. On
failure, return
400. - Acknowledge fast. Return
2xx(e.g.204) immediately; do real work in a background job/queue if it can exceed a second or two. - Branch on the payload (event type) and process.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 146 lines · 56 tokens per session scan C 62ee939641e9
receiving-webhooks is a skill published in the GitHub repository svix/ai (18 stars, last pushed 10d ago), licensed MIT. It adds 56 tokens to every session and 1,552 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (harvests environment variables, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hermes-self-evaluation
Use this skill when the user asks to audit, review, or optimize Hermes's own performance — analyzing session data, skills, configuration, costs, and usage patterns to identify improvements, automation opportunities, and system optimizations.
mnemosyne-maintenance
Use when: upgrading Mnemosyne, diagnosing slow/hung consolidation (mnemosynesleep), fixing missing embeddings, or troubleshooting import/version mismatches.
hermes-self-evaluation
Use this skill when the user asks to audit, review, or optimize Hermes's own performance — analyzing session data, skills, configuration, costs, and usage patterns to identify improvements, automation opportunities, and system optimizations.
hermes-tweet
Search Twitter/X, read tweet replies, look up users, monitor tweets, export followers, and gate X actions through Xquik.
mnemosyne-maintenance
Use when: upgrading Mnemosyne, diagnosing slow/hung consolidation (mnemosynesleep), fixing missing embeddings, or troubleshooting import/version mismatches.
new
Create a new project to start development quickly.