Agent skill
webform
Use when receiving and verifying GTM OS website form submissions or Horizon-Scan webhook events.
Filed under ABM and paid.
From ay-automate/gtmos-skills · 107 skill entries · 0 · pushed 2026-11-02
What it does when it runs
Use when receiving and verifying GTM OS website form submissions or Horizon-Scan webhook events.
Automated analysis of the skill and the 0 files bundled beside it. A skill’s own description is written to be selected by an agent, so it describes the job and not the dependencies.
- Keys and connectors you must supply
- None found.
- Hosts it reaches
- developer.mozilla.org
- Tool permissions it declares
- No
allowed-toolsin the frontmatter. It only issues instructions, so there is nothing to bound. - Actions present in the files
- None. Instructions only.
Ask about webform
Opens your assistant with this page's recorded context. Check the linked sources before relying on it.
Install it
View source on GitHub ↗git clone --depth 1 --filter=blob:none --sparse https://github.com/ay-automate/gtmos-skills.git /tmp/gtmos-skills git -C /tmp/gtmos-skills sparse-checkout set "skills/webform" mkdir -p ~/.claude/skills/webform cp -R "/tmp/gtmos-skills/skills/webform/." ~/.claude/skills/webform/
Picked up without a restart. A project skill of the same name is shadowed by your personal one. For one repository only, swap ~/.claude/skills for .claude/skills. Claude Code docs ↗
Or take the whole library
This repo ships a .claude-plugin manifest, so Claude Code can install all 107 skills at once. Plugin skills are invoked as /<plugin>:<skill>, so they never collide with your own.
/plugin marketplace add ay-automate/gtmos-skills /plugin
The folder is the same in every client that implements the format — 46 of them — so if yours is not above, only the destination changes.
The skill
Source on GitHub ↗Reproduced in full from ay-automate/gtmos-skills/blob/86780d2f545cdc0a1de971917aa04b41bb0b3ccd/skills/webform/SKILL.md, which is licensed MIT (repository). 617 words, 10 headings.
webform with GTM OS
When to use this skill
Use when receiving and verifying GTM OS website form submissions or Horizon-Scan webhook events.
What GTM OS uses it for
Inbound webform webhook verification and lead ingest; not a general website builder or form sender.
Capabilities and operation names are listed below as they appear in the connector package and
coverage map. Discover the live input and output schema with gtm describe before invocation;
the registry for the current organization is authoritative if it differs from this static guide.
webform.ingest_form_webhookverifies and ingests supported form events.- Maps supported fields to
gtm.contact,gtm.account, andgtm.signal.
Connect it
Create an org-scoped webform connection with an inbound webhook signing secret. Configure the website to post to the deployment's documented webhook URL and store the same secret in the server connection. The webhook is HMAC-verified.
No OAuth scopes are required for inbound HMAC verification. Use a unique, high-entropy signing secret per org/form endpoint and rotate it through the connection flow if exposed.
Use the console Connections/settings page for the provider when present. For CLI setup, inspect
gtm connect --help and use the provider name supported by the installed CLI; do not guess
flags or paste credentials into command history. Restart/reload the configured instance only
through its documented operator workflow.
Canonical data
- Ingest can resolve/create
gtm.contactandgtm.accountand emitgtm.signal. - Do not assume arbitrary submitted fields map to canonical fields.
- Preserve submission source, timestamp, and verification evidence.
Read and write records through registered operations and gtm.* objects only. A vendor-side
record is not automatically a canonical GTM OS record; use the connector's declared mapping and
retain source provenance. Do not infer fields from the vendor API.
Governance and safety
A form submission is not blanket marketing consent. Record consent only when the form contract supplies it; enforce opt-outs and suppression before follow-up. Ingesting a lead must never auto-trigger an unapproved email or LinkedIn send.
- E-class/customer-facing writes are proposed for approval; a different human approves them.
- Respect consent, suppression, unsubscribe, and do-not-contact state before any person-level action.
- Honor configured spend/budget caps. Do not retry a billable request blindly after timeout.
- Keep connection secrets in the sealed connection or server environment. Never print or commit them.
Common errors and recovery
-
Signature invalid: compare raw-body signature algorithm and secret; never disable verification to accept traffic.
-
Duplicate submission: use the connector's event identity/idempotency.
-
Invalid fields: inspect the schema and preserve unknown data only as permitted.
-
No contact match: don't merge by name alone.
-
Check the connection state and provider health before retrying; use the connector's fixture mode only for development.
-
Read the operation error and lineage/receipt before changing inputs or repeating a write.
-
If the provider is not registered, stop and report that limitation; do not call the vendor directly as a workaround.
Do
- Read the connector entry in
docs/gtmos/reference/connections.mdand the currentgtm describeschema before a new integration action. - Start with a read or one narrowly scoped test, confirm provenance, then scale within the approved budget.
- Ask a human to resolve missing consent, expired credentials, or approval-required actions.
Don't
- Don't invent endpoints, scopes, operation names, or object fields.
- Don't bypass GTM OS governance with direct vendor writes or direct database edits.
- Don't send messages, change campaigns, or publish content without the operation's approval path.
Official vendor documentation
https://developer.mozilla.org/en-US/docs/Web/HTTP (webhook signature mechanics are defined by the GTM OS endpoint contract; configure the form vendor using its own webhook documentation).
GTM OS reference: docs/gtmos/reference/connections.md (installed by gtm init) and the live gtm describe schema.
Need help setting it up?
This page tells you what webform does and what it needs. Cheetah builds the agent setup it runs inside: data, CRM, sequencing and the guardrails.
Book a call →The directory stays free. There is nothing gated behind this.