A skill for building and troubleshooting an Xweather Webhooks receiver. Webhooks let Xweather push weather data to an HTTPS endpoint your application owns instead of making the application request the data repeatedly.

Use it to design, build, secure, or debug a receiver for pushed Xweather data, while distinguishing receiver work from the separate subscription and endpoint-registration process.

It helps avoid frequent polling, which uses repeated requests and can delay unpredictable updates such as lightning, hail, alerts, or storm-cell changes.

webhooks — Skill for Claude Code by vaisala-xweather

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add vaisala-xweather/xweather-agent-skills --skill webhooks

Clone the repo

git clone --depth 1 https://github.com/vaisala-xweather/xweather-agent-skills

Made for: Claude Code.

Or install xweather, the plugin that ships this one along with the rest of its 6 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/vaisala-xweather/xweather-agent-skills/webhooks/github.svg)](https://agentmods.dev/skills/vaisala-xweather/xweather-agent-skills/webhooks)

Your own site

<a href="https://agentmods.dev/skills/vaisala-xweather/xweather-agent-skills/webhooks"><img src="https://agentmods.dev/badge/skills/vaisala-xweather/xweather-agent-skills/webhooks/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/vaisala-xweather/xweather-agent-skills/webhooks"><img src="https://agentmods.dev/badge/skills/vaisala-xweather/xweather-agent-skills/webhooks.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 144 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,907 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00144	$0.02907
Opus 5.5	$0.00058	$0.01163
Sonnet 5.5	$0.00029	$0.00581
Haiku 4.5	$0.00014	$0.00291

Measured 16d ago against content hash 7383b98cd258, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

webhooks scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/xweather/skills/webhooks/SKILL.md · 244 lines

How it starts

The opening of the file, as written. The whole thing — 244 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Xweather Webhooks

Xweather pushes data sets to an HTTPS endpoint you own, instead of your application polling data.api.xweather.com on a timer. The payload is byte-for-byte the same shape the Weather API returns, so existing response-parsing code is reusable with almost no change.

Webhooks are a premium add-on requiring a separate subscription, and endpoints are registered by Xweather staff — not self-service. There is no API call or dashboard toggle that turns this on. Say so early: the work splits into what the user can build today (the receiver) and what needs a conversation with their account executive (the subscription and registration).

When webhooks are the right answer

Reach for them when the user is polling frequently for data that changes unpredictably — lightning strikes, hail threats, new alerts, storm cell updates. Polling that on a short interval burns accesses continuously and still adds latency; push removes both problems.

Polling via the weather-api skill stays the better fit when the data is requested on demand (a user opens a page), when the update cadence is slow and predictable (daily normals, hourly temperatures), or when the user can't host a public HTTPS endpoint.

How a delivery works

Xweather sends an HTTP POST to the registered URL.


Method	`POST`
`Content-Type`	`application/json`
`x-api-key`	A client-generated shared secret, proving the delivery came from Xweather. May be a query parameter instead of a header, if preferred.
Body	The standard Xweather API response envelope — JSON or GeoJSON, whichever was configured

The endpoint must answer with a 2xx status — 202 is the conventional choice — and do it immediately. The response body is ignored.

Acknowledge first, process second. Any real work belongs in a background job, queue, or thread started after the status is written. A handler that parses, matches polygons, and sends notifications before responding will eventually exceed the delivery timeout, and a timeout is treated as a failed delivery.

Read the full file on GitHub · 244 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

16d ago Changed 7383b98cd258
18d ago Changed 98176077ffe5
29d ago Changed d1ed32d241ef
1mo ago Changed 3c898003d0ec
1mo ago Changed f8eb14cc1e65
2mo ago Changed 02ae81cebf2b
2mo ago First seen · 244 lines · 144 tokens per session scan A cd843808fae1

Subscribe to this mod's changes

webhooks is a skill published in the GitHub repository vaisala-xweather/xweather-agent-skills (6 stars, last pushed 16d ago), licensed MIT. It adds 144 tokens to every session and 2,907 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs

webhooks next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
webhooksvaisala-xweather/xweather-agent-skills	Skill	6	16d ago	MIT	A	144	Claude Code
mem0-oss-to-platformmem0ai/mem0	Skill	69k	5d ago	Apache-2.0	A	217	Claude Code, Codex
azure-mgmt-botservice-dotnetmicrosoft/skills	Skill	3.2k	yesterday	MIT	A	78	Claude Code
fastapi-router-pymicrosoft/skills	Skill	3.2k	yesterday	MIT	A	46	Claude Code
dev-runtimelangwatch/langwatch	Skill	5.0k	today	Apache-2.0	A	172	Claude Code
api-designericrisco/rsc-harness	Skill	579	yesterday	MIT	A	105	Claude Code, Codex
migrate-segw-to-raparc-mcp/arc-1	Skill	257	2d ago	MIT	A	106	Claude Code