Openhook Cli

Receive real-time webhook events from platforms like GitHub, Stripe, Linear, and coordinate multi-agent workflows via messaging channels.

Security Scan

The skill’s documentation matches its stated webhook-and-channel purpose, but the package metadata omits the required OPENHOOK_API_KEY and the channel/endpoint features can be used to forward arbitrary data to external endpoints — verify before installing.

Purpose & Capability

The SKILL.md describes receiving webhooks (GitHub, Stripe, etc.) and coordinating agent-to-agent channels — requiring an Openhook API key is coherent with that purpose. However, the registry metadata lists no required environment variables while the SKILL.md explicitly requires OPENHOOK_API_KEY, an inconsistency between declared metadata and the instructions.

Instruction Scope

Instructions are mostly limited to using the openhook CLI (subscribe, listen, daemon, channel create/subscribe/send). They do not ask the agent to read unrelated local files or arbitrary environment variables. One behavioural risk: channels and endpoints allow sending messages (and therefore arbitrary payloads) to other agents or endpoints — this is expected for the feature but expands the surface for data transfer/exfiltration.

Install Mechanism

The skill is instruction-only (no install spec), but the README recommends installing via a Homebrew tap (openhook-dev/openhook) hosted on GitHub. That is a standard source, but because there is no enforced install spec, the agent or user could be running different versions or binaries from other locations — verify the tap and binary provenance before executing.

Credentials

The SKILL.md requires OPENHOOK_API_KEY (oh_live_ or oh_test_) to operate. The registry metadata, however, lists no required env vars or primary credential — this mismatch is concerning. The single API key is proportionate to the functionality, but it grants full access to the user's Openhook account (subscriptions, channels, messages), so treat the key as sensitive and prefer a scoped/test key where possible. The instructions also reference endpoint IDs and channel IDs (which act like additional credentials) but do not document how they should be secured.

Persistence & Privilege

The skill does not request always: true, does not include install-time code, and does not request system-wide configuration changes. It can be invoked autonomously (default) which is normal for skills; combine this with the API key access when assessing risk.

What to consider before installing

Before installing: verify the Homebrew tap and the GitHub repo (https://github.com/openhook-dev/openhook-cli) to ensure the CLI is the legitimate project; confirm that OPENHOOK_API_KEY is required (the registry metadata omission is likely an error) and consider creating a limited-scope or test key (oh_test_*) for evaluation. Understand that channels/endpoints can ferry arbitrary data to external recipients — do not send secrets or internal-only payloads through openhook channels. Restrict agent autonomy if you do not want the agent to send messages or create subscriptions without explicit approval. If anything about the provenance, API key scope, or endpoint IDs is unclear, ask the publisher for clarifying documentation before granting access.

Use the openhook CLI to receive real-time events from external platforms and communicate with other agents through channels.

When to use

• Receiving webhook events from GitHub, Stripe, Linear, Vercel, Slack
• Listening for external platform events in real-time
• Sending messages to other agents through channels
• Coordinating multi-agent workflows

Installation

brew tap openhook-dev/openhook && brew install openhook

Authentication

Requires an API key from openhook. The user must:

1. Sign up at https://openhook.dev/signup
2. Go to Settings > API Keys
3. Create a new API key (starts with oh_live_ or oh_test_)

Then authenticate:

openhook auth login --key oh_live_xxxxxxxx

# Verify authentication worked
openhook whoami

Receiving Events

Subscribe to platform events

# GitHub
openhook subscribe github --repo owner/repo --events push,pull_request,issues

# Stripe
openhook subscribe stripe --events payment_intent.succeeded,customer.created

# Linear
openhook subscribe linear --events issue.created,issue.updated

Listen for events

# Interactive output
openhook listen

# JSON output (for parsing)
openhook listen --json

# Pipe to your processing script
openhook listen --json | jq '.payload'

Background daemon

openhook daemon start
openhook daemon status
openhook daemon logs -f
openhook daemon stop

Channels (Agent-to-Agent Communication)

Channels let agents send messages to each other. Each agent subscribes to a channel with a unique name, then messages can be sent to specific agents or broadcast to all.

Create a channel

openhook channel create <name> [--description "..."]

# Example
openhook channel create deploy-team --description "Deployment coordination"

Subscribe to a channel

Each subscription needs:

• --endpoint: The HTTP endpoint ID that will receive messages
• --name: A unique alias for this agent in the channel

openhook channel subscribe <channel-id> --endpoint <endpoint-id> --name <alias>

# Example: Subscribe the "deployer" agent
openhook channel subscribe ch_abc123 --endpoint ep_xyz789 --name deployer

List channel members

openhook channel members <channel-id>
openhook channel members <channel-id> --json

Send messages

# Send to specific agent
openhook channel send <channel-id> "<message>" --to <agent-name>

# Broadcast to all agents
openhook channel send <channel-id> "<message>" --to all

# Include sender info
openhook channel send <channel-id> "<message>" --to <agent-name> --from <your-name>

Channel workflow example

# 1. Create coordination channel
openhook channel create release-v2 --description "v2.0 release coordination"

# 2. Agents join with their endpoints
openhook channel subscribe ch_xxx --endpoint ep_builder --name builder
openhook channel subscribe ch_xxx --endpoint ep_tester --name tester
openhook channel subscribe ch_xxx --endpoint ep_deployer --name deployer

# 3. Coordinate the release
openhook channel send ch_xxx "build v2.0.0" --to builder --from coordinator
openhook channel send ch_xxx "run integration tests" --to tester --from builder
openhook channel send ch_xxx "deploy to staging" --to deployer --from tester
openhook channel send ch_xxx "v2.0.0 deployed successfully" --to all --from deployer

Managing subscriptions

# List all subscriptions
openhook list

# View event history
openhook events

# Remove subscription
openhook unsubscribe <subscription-id>

Common patterns

Wait for specific event

# Listen until you get the event you need
openhook listen --json | while read -r event; do
  type=$(echo "$event" | jq -r '.event_type')
  if [ "$type" = "push" ]; then
    echo "$event" | jq '.payload'
    break
  fi
done

React to GitHub push

openhook subscribe github --repo myorg/myrepo --events push
openhook listen --json | jq -c 'select(.event_type == "push") | .payload.commits'

Reference

Command	Description
openhook whoami	Show authenticated user
openhook subscribe <platform>	Subscribe to platform events
openhook list	List subscriptions
openhook unsubscribe <id>	Remove subscription
openhook listen [--json]	Listen for events
openhook events	View event history
openhook channel create <name>	Create channel
openhook channel list	List channels
openhook channel subscribe <ch> --endpoint <ep> --name <alias>	Join channel
openhook channel members <ch>	List members
openhook channel send <ch> <msg> --to <name|all>	Send message

Links

• Website: https://openhook.dev
• Dashboard: https://openhook.dev/dashboard
• GitHub: https://github.com/openhook-dev/openhook-cli