hookpipe

Reliable webhook infrastructure for AI agents. Receive webhooks from Stripe, GitHub, Slack, Shopify, Vercel with signature verification, durable queuing, and...

Security Scan

The skill is internally consistent with its stated purpose (it requires a hookpipe CLI and its SKILL.md only instructs using that CLI to receive and forward webhooks), but installing a third‑party CLI from npm or a non-core Homebrew tap carries normal supply‑chain risk you should review before installation.

Purpose & Capability

The name/description (reliable webhook ingestion and delivery) matches the declared requirement: a 'hookpipe' CLI binary and commands shown in SKILL.md. Requiring the hookpipe binary is expected for this purpose.

Instruction Scope

SKILL.md only instructs running the hookpipe CLI (connect, dev, tail, etc.) and configuring an api_url/token or provider secrets to forward events to a local gateway. It does not ask the agent to read unrelated files, environment variables, or system secrets.

Install Mechanism

Install specs point to an npm package 'hookpipe' and a brew formula 'hookpipe/hookpipe/hookpipe'. Installing arbitrary packages from npm or a non-core Homebrew tap is a common but nontrivial supply‑chain risk — the CLI will execute code on your machine. No direct red flags in the SKILL.md, but verify the package source, maintainers, and release artifacts before installing.

Credentials

The skill declares no required env vars and the instructions accept provider signing secrets and a hookpipe token via CLI arguments; this is proportionate to its role. Note: the token name shown (e.g., 'hf_sk_xxx') looks like a typical API token placeholder — confirm which service the token belongs to before storing it in the CLI.

Persistence & Privilege

always is false and the skill does not request system-wide config access. The CLI will likely store its own configuration/token locally if used, which is normal for a user‑installed tool.

Assessment

This skill appears to be what it says: a wrapper around a 'hookpipe' CLI that buffers and forwards webhooks. Before installing or running it: (1) verify the npm package and Homebrew tap are the official hookpipe project (check the GitHub repo and package authors), (2) inspect the package or formula source and release checksums if possible, (3) avoid running installs as root, pin a version, and review what the CLI stores locally (tokens/config), (4) only provide signing secrets and tokens you control and understand (do not paste production secrets without verifying the service), and (5) if you rely on Cloudflare Workers or a hosted endpoint, confirm the hosted endpoint is legitimate. If you can’t verify the package origin, treat installation as higher risk.

hookpipe — Webhook Infrastructure for AI Agents

hookpipe receives webhooks from external services, queues them durably, and delivers them to your agent with automatic retries. Your agent never misses an event, even during restarts or downtime.

Why Use This

Without hookpipe, webhooks sent while your OpenClaw gateway is restarting or offline are lost forever. Most providers send once and move on. hookpipe sits in between — it's always online (Cloudflare Workers, 300+ edge locations), accepts the webhook immediately, and retries delivery to your gateway until it succeeds.

Quick Start

Local development (receive webhooks on your machine)

hookpipe dev --port 18789 --provider stripe --secret whsec_xxx

This creates a secure tunnel to your OpenClaw gateway. Paste the printed Webhook URL into your Stripe Dashboard. No port forwarding, no IP exposure.

Production setup (persistent, survives restarts)

# 1. Deploy hookpipe (one-click on Cloudflare, or self-host)
# 2. Configure CLI
hookpipe config set api_url https://your-hookpipe.workers.dev
hookpipe config set token hf_sk_xxx

# 3. Connect a provider to your OpenClaw gateway
hookpipe connect stripe \
  --secret whsec_xxx \
  --to http://localhost:18789/webhook \
  --events "payment_intent.*"

hookpipe returns a Webhook URL — register it in Stripe's dashboard. Events are now durably queued and delivered to your gateway with retries.

Built-in Providers

hookpipe providers ls

Provider	Events	Use case
stripe	payment_intent, customer, invoice, charge	Payment notifications
github	push, pull_request, issues, release	Code events, PR review
slack	message, app_mention, reaction	Team notifications
shopify	orders, products, customers	E-commerce events
vercel	deployment, domain	Deploy monitoring

Discover a provider's events:

hookpipe providers describe stripe --json

Any other webhook service

Not limited to the 5 built-in providers. For any service already sending webhooks to your agent, use generic HMAC verification:

hookpipe connect my-service --secret my_signing_secret --to http://localhost:18789/webhook

For services with non-standard signature formats, the community can create custom providers with defineProvider() — a single file that defines verification method, event types, and payload schemas. See Provider Design Guide.

Core Workflows

Stripe payment alerts

hookpipe connect stripe --secret whsec_xxx --to http://localhost:18789/webhook --events "payment_intent.payment_failed"

Agent receives failed payment events and can draft follow-up emails, create support tickets, or alert the team.

GitHub PR auto-review

hookpipe connect github --secret ghsec_xxx --to http://localhost:18789/webhook --events "pull_request"

Agent receives PR events instantly and can review code, post comments, or run checks.

Multi-provider monitoring

hookpipe connect stripe --secret whsec_xxx --to http://localhost:18789/webhook --name stripe-prod
hookpipe connect github --secret ghsec_xxx --to http://localhost:18789/webhook --name github-prod
hookpipe connect vercel --secret vsec_xxx --to http://localhost:18789/webhook --name vercel-prod

All events flow to your gateway through one durable pipeline. Restart your gateway freely — nothing is lost.

Monitor events in real-time

hookpipe tail --json

Stream events as they arrive. Pipe to scripts or other agents:

hookpipe tail --json | jq '.event_type'

What Happens During Downtime

Your gateway goes down at 2:00 AM
  ↓
Stripe sends payment_intent.succeeded at 2:15 AM
  → hookpipe accepts (202), queues durably
  ↓
GitHub sends push at 2:30 AM
  → hookpipe accepts (202), queues durably
  ↓
hookpipe retries delivery every few minutes (exponential backoff)
  ↓
Your gateway comes back at 6:00 AM
  → hookpipe delivers both events automatically
  → Agent processes them as if nothing happened

No manual replay needed. No events lost. Circuit breaker protects your gateway from being overwhelmed on recovery.

CLI Reference

hookpipe connect <provider> --secret <s> --to <url> [--events <filter>]
hookpipe dev --port <n> [--provider <name>] [--secret <s>]
hookpipe providers ls [--json]
hookpipe providers describe <name> [--json]
hookpipe tail [--json] [--source <id>]
hookpipe events ls [--json] [--limit <n>]
hookpipe health [--json]

All commands support --json for structured output and --dry-run for validation.

Key Facts

• Runs on Cloudflare Workers — always online, $0 idle cost
• Retries with exponential backoff up to 24 hours
• Circuit breaker pauses delivery to unhealthy destinations
• Built-in idempotency (no duplicate deliveries)
• Apache 2.0 license, fully open source
• GitHub: https://github.com/hookpipe/hookpipe