Github Webhooks

This handles GitHub webhook verification and event parsing so you don't have to dig through docs every time you wire up a new handler. The core is the signature verification code (HMAC SHA-256 with timing-safe comparison) in Node and Python, plus a reference table of common events like push, pull_request, and issues. It's from Hookdeck, so they obviously want you using their tunnel for local dev, but the verification snippets are solid and you can drop them anywhere. Worth pairing with their webhook-handler-patterns skill if you need idempotency or retry logic, otherwise just grab the crypto code and move on.

skills.sh installs: 507
GitHub stars: 100
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add hookdeck/webhook-skills --skill github-webhooks --agent claude-code

Installs into .claude/skills of the current project.

Files

GitHub Webhooks

When to Use This Skill

Setting up GitHub webhook handlers
Debugging signature verification failures
Understanding GitHub event types and payloads
Handling push, pull request, or issue events

Verification (core)

GitHub signs the raw body with HMAC-SHA256 keyed on your webhook secret and sends the digest in X-Hub-Signature-256 formatted as sha256=<hex>. Use X-Hub-Signature-256 (not the legacy SHA-1 X-Hub-Signature), pass the raw body, and compare timing-safe.

Node:

const crypto = require('crypto');

function verify(rawBody, signatureHeader, secret) {
  const [algo, sig] = (signatureHeader || '').split('=');
  if (algo !== 'sha256' || !sig) return false;
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  try {
    return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
  } catch {
    return false;
  }
}

Python: