Borrowing it
Nothing to install: this file belongs to webhook-co/webhook. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/webhook-co/webhook/main/.claude/skills/infra-deploy-runbook/SKILL.mdgit clone --depth 1 https://github.com/webhook-co/webhookWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/webhook-co/webhook/infra-deploy-runbook)<a href="https://agentmods.dev/skills/webhook-co/webhook/infra-deploy-runbook"><img src="https://agentmods.dev/badge/skills/webhook-co/webhook/infra-deploy-runbook/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/webhook-co/webhook/infra-deploy-runbook"><img src="https://agentmods.dev/badge/skills/webhook-co/webhook/infra-deploy-runbook.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.00489 |
| Opus 5.5 | $0.00019 | $0.00196 |
| Sonnet 5.5 | $0.00009 | $0.00098 |
| Haiku 4.5 | $0.00005 | $0.00049 |
Grade A, and why
infra-deploy-runbook scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Infra deploy runbook
Operate the Cloudflare-forward stack (Workers + Durable Objects, Neon via Hyperdrive, R2, KV) and the container-delivery lane behind the seam.
Before any deploy
- Confirm the change is reproducible from
infra/and carries no secrets or account/zone IDs. - Run a plan/dry-run first (
wrangler deploy --dry-run, IaC plan). Read the diff. - Identify blast radius: does it touch DNS/routing for
webhook.coorwbhk.my, drop/recreate resources, or rotate production secrets? If yes → stop and get human review.
Deploy order (per service)
- Apply additive changes first (new bindings, new DO classes, expand-phase migrations).
- Deploy the Worker/service; verify health + OpenTelemetry traces before shifting traffic.
- Watch error rate and delivery latency; keep the previous version ready to roll back.
Guardrails (non-negotiable)
- Default new compute to Workers / DO. Don't reintroduce rejected stack alternatives without an ADR.
- Preserve the container-delivery seam — never couple the engine to a specific delivery backend.
- Keep
wbhk.myingestion cookieless, no-CORS, path-token routed,404for unknown tokens. - Secrets via
wrangler secret/ secret store only. No literals, no account IDs in the repo.
Rollback
- Workers: redeploy the prior version. DO: ensure schema is backward-compatible before cutover so rollback is safe. Migrations: only ship the contract phase once rollback is no longer needed.
Progressive disclosure
Put environment-specific checklists, binding maps, and step-by-step rollback drills in
references/ (e.g. references/rollback.md) and link them here rather than inlining detail.
references/www-static-assets.md— deployapps/wwwto www.webhook.co (assets-only Worker,_headers, apex→www redirect, HSTS, GitHub Actions CD).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 43 lines · 47 tokens per session scan A 90b0af0a9b1c
infra-deploy-runbook is a skill published in the GitHub repository webhook-co/webhook (0 stars, last pushed 18d ago), licensed Apache-2.0. It adds 47 tokens to every session and 489 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
api-workers
Cloudflare Workers deployment using createWorkerHandler from @cyanheads/mcp-ts-core/worker. Covers the full handler signature, binding types, CloudflareBindings extensibility, runtime compatibility guards, and wrangler.toml requirements.
cve
Look up CVE records via x cve — cached, zero-API-key, daily xz TSV. Load for cve, vulnerability id, kev, epss, nvd, cvelist, or security advisory.
wikipedia
Search and read Wikipedia via x wkp — MediaWiki API, no API key, zero install; query, extract, suggest, and DDG route in one module. Load for wiki, wikipedia, encyclopedia lookup, article summary.
api-less-website
api-less-website skill — placeholder, documentation to be added. Do not load as a real skill yet.
add-provider
Add a new storage or service provider to the core package. Use when implementing a new backend for StorageService (e.g., a new database) or a new service provider (e.g., a new LLM backend).
huawei-cloud-apig-instance-management
Manage Huawei Cloud APIG (API Gateway, dedicated instances) via hcloud CLI: instance lifecycle (create/list/delete), API groups, API create/update/delete, publish/offline, request throttling policies, signature keys, access control (ACL) policies, and public ingress EIP binding, plus read-only diagnosis of public…