CC3PO Webhook

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:10 AM UTC
• Version: 1.0.0

Overview

This is a non-executable webhook security guidance skill whose behavior is coherent, with one logging recommendation users should tighten before applying.

This skill is reasonable to install as webhook implementation guidance. When applying it, avoid logging full webhook URLs, tokens, query strings, headers, payloads, or response bodies by default; prefer endpoint identifiers, status codes, timings, sizes, correlation IDs, redaction, access controls, and short retention.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Sensitive Webhook URLs and Response Bodies May Be Exposed in Logs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 82
Vulnerability Type: Sensitive information exposure through excessive logging
Risk Level: Medium

Complete Code Snippet:

markdown

- Log every attempt: URL, status code, response time, response body

Technical Analysis

The skill directs implementers to record complete webhook URLs and response bodies for every delivery attempt without requiring redaction or data minimization.

Webhook URLs commonly contain opaque endpoint credentials, signatures, API keys, tenant identifiers, or bearer-like tokens in query parameters or path segments. Response bodies may contain confidential application data, personal information, internal diagnostics, or credentials. Recording these values verbatim expands their exposure to log aggregation systems, operational dashboards, backups, support personnel, and other users with log-reading permissions.

Although line 48 separately recommends redacting sensitive fields when logging failed inbound payloads, that safeguard is not included in the delivery-tracking instruction at line 82.

Attack Path

1. An application follows the skill guidance and stores the complete destination URL and response body for every webhook delivery.
2. A webhook endpoint contains an authentication token or signature in its path or query string, or returns sensitive content in its response.
3. The complete value is forwarded to application logs, an observability service, a debugging dashboard, or a log backup.
4. A lower-privileged operator, compromised logging account, malicious support user, or attacker with read access to exported logs retrieves the sensitive value.
5. Where the exposed value remains valid, the attacker reuses it to access or impersonate the webhook endpoint. Sensitive response content may also be disclosed directly.

Impact Assessment

Exploitation requires access to the affected logs or logging infrastructur ...[truncated 523 chars]

Remediation

View remediation

Remediation Suggestions

• Replace full destination URLs in logs with a non-sensitive endpoint identifier and, when operationally necessary, the normalized scheme and host only.
• Remove URL user information and redact query values, signatures, tokens, secret path segments, authorization headers, and other credentials before logging.
• Do not record webhook response bodies by default. Prefer status codes, response times, body sizes, and correlation identifiers.
• If limited response content is necessary for diagnostics, use an explicit field allowlist, enforce strict size limits, and apply structured redaction before storage.
• Apply least-privilege access controls to webhook delivery logs and audit access to them.
• Encrypt logs in transit and at rest, define short retention periods, and ensure that backups and third-party observability platforms receive the same protections.
• Add automated tests with representative secret-bearing URLs and sensitive response fields to verify that logging filters cannot expose them.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

## Sending: Retry Strategy

- Exponential backoff: 1min, 5min, 30min, 2h, 8h—then give up or alert
- Cap retries (5-10 attempts)—don't retry forever
- Record delivery attempts—show status to user
- Different retry for 4xx vs 5xx—4xx often means stop retrying

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

- 5-10 second timeout—don't wait forever for slow receivers
- Treat timeout as failure—retry later
- Don't follow redirects—or limit to 1-2; prevents redirect loops
- Validate HTTPS certificate—don't skip verification

## Event Design