From openfunnel
Consumes OpenFunnel live view alert webhooks via public HTTPS listener, verifies HMAC-SHA256 signatures, parses saved-view insight payloads, and processes alerts safely. Use for bots receiving webhook alerts.
npx claudepluginhub openfunnel/openfunnel-skillsThis skill uses the workspace's default tool permissions.
Use this skill when working with OpenFunnel live view alerts delivered by webhook.
Guides Payload CMS config (payload.config.ts), collections, fields, hooks, access control, APIs. Debugs validation errors, security, relationships, queries, transactions, hook behavior.
Builds production-ready Apache Airflow DAGs with patterns for operators, sensors, testing, and deployment. For data pipelines, workflow orchestration, and batch jobs.
Share bugs, ideas, or general feedback.
Use this skill when working with OpenFunnel live view alerts delivered by webhook.
In the backend, these alerts are implemented as saved-view webhooks. A webhook fires when new timeline insights match a saved view that has webhook delivery enabled.
When asked to use live view alerts, the bot should assume that OpenFunnel is the sender and the bot's system is the receiver.
The bot should help the user do these things:
2xx response after the event is durably accepted.The receiving system must have:
/webhooks/openfunnel/live-view-alerts.Do not tell the user to use localhost as the final destination. Local tunnels can be used temporarily for testing, but production must be a real public HTTPS endpoint.
Assume the webhook is sent immediately when new insights match the saved view.
Production webhook behavior:
POSTapplication/jsonX-OpenFunnel-SignatureX-OpenFunnel-TimestampUser-Agent: OpenFunnel-Webhook/1.01s, 2s, 4s)5xx responses4xx responsesThis means:
2xx once the event has been safely accepted.5xx for temporary failures if you want OpenFunnel to retry.4xx for transient issues because that stops retries.Production webhook requests are signed with HMAC-SHA256.
Verify the signature using:
X-OpenFunnel-Timestamp headerThe signature input is:
{timestamp}.{raw_body}
The expected signature format is:
sha256=<hex_digest>
The bot must verify against the raw request body exactly as received. Do not parse JSON and then stringify it again before verifying.
Pseudo-logic:
X-OpenFunnel-TimestampX-OpenFunnel-Signaturetimestamp + "." + raw_bodyThe webhook body is JSON with this structure:
{
"event_type": "insights.new",
"event_timestamp": "2026-02-19T14:30:00.000Z",
"view": {
"id": "123",
"name": "Enterprise Accounts"
},
"summary": {
"total_insights": 3,
"total_accounts": 2
},
"accounts": [
{
"account_id": 1,
"account_name": "Acme Corp",
"account_domain": "acme.com",
"insights": [
{
"alert_text": "New VP of Engineering hired from competitor",
"alert_type": "openfunnel",
"alert_date": "2026-02-19",
"sentiment": "positive",
"discovered_signal_id": 1001
}
]
}
]
}