skills.rest
Flintmere
FlintmereOFFICIAL
Explore all skills by this author →
GitHub

webhook-review

Review webhook handlers for signature verification, idempotency, error handling, and observability.

Updated Apr 18, 2026
Search Tags:#security#observability#review#webhook#idempotency#incident
One-click install
npx skills add https://github.com/Flintmere/flintmere --skill webhook-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: webhook-review
Source: https://github.com/Flintmere/flintmere/tree/main/.claude/skills/webhook-review
Command: npx skills add https://github.com/Flintmere/flintmere --skill webhook-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Webhook handlers are common attack vectors and operational blind spots. This skill reads handlers cold and produces an auditable, read-only review detailing signature verification, idempotency, error handling, side-effect safety, and observability to help teams detect and triage issues before incidents.

Core Features & Use Cases

  • Read-only webhook evaluations that verify signatures, payload parsing, and idempotency requirements.
  • Observability checks including error handling, logging, and retry behavior, with incident-history correlation for informed remediation.
  • Structured findings with severity classifications and clear handoffs to specialized skills like implement-checkout-flow or fix-bug (security-review escalation when needed).

Quick Start

Install dependencies and run the webhook-review scan against your codebase to generate a structured review.

Frequently Asked Questions about webhook-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review webhook handlers for signature verification and idempotency?▼

Reviewing webhook handlers involves scanning src/app/api/**/webhook/** paths to evaluate signature verification, payload parsing, and idempotency requirements. The process generates a structured report with severity classifications to triage operational blind spots.

What does a webhook security audit check for in error handling and observability?▼

A webhook security audit checks error handling, logging, retry behavior, and side-effect safety. It correlates findings with incident-history.md to inform triage and remediation planning for operational webhook failures.

Can I automate webhook code review for handlers located under src/app/api?▼

You can automate webhook code review by running a read-only scan against handlers located under src/app/api/**/webhook/**. This identifies signature verification gaps and classifies findings by severity without modifying the codebase.

How do I triage webhook incidents using past incident history?▼

Triageing webhook incidents involves cross-referencing handler reviews with incident-history.md. This correlation maps current signature verification or idempotency gaps to past operational failures, producing severity classifications for remediation planning.

When should I escalate webhook findings to a security review?▼

Escalate webhook findings to a security review when signature verification or side-effect safety issues are detected. The review outputs explicit handoffs to security-review, fix-bug, or implement-checkout-flow based on P0–P3 severity classifications.

Related Skills

Explore More Software Engineering Skills→
blocknaviblocknavi
1

convex-http-actions

Expose HTTP endpoints for Convex webhooks and external API calls.

Official
Advanced
CatsofsufferingCatsofsuffering
5

audit

Audit frontend components and pages with scored P0-P3 severity reports.

Community
Advanced
git-taogit-tao

webhook-safety

Verify webhook signatures and enforce idempotent event processing.

Community
Intermediate
OneWave-AIOneWave-AI
245

code-review-pro

Review code for security vulnerabilities, performance bottlenecks, and maintainability issues.

Official
Basic