Security audit
Security checks for vulnerabilities and agentic risk
This is a small webhook-debugging skill whose request capture, local history, replay, and forwarding behavior matches its stated purpose, though users should treat captured webhook data as sensitive.
Install only if you need local webhook debugging. Use test webhook data where possible, avoid capturing production secrets, clear local history when done, and double-check any replay or forward target URL because captured request contents may be sent there.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- `webhook list` - Show request history
- `webhook show <id>` - Show request details
- `webhook replay <id> <url>` - Replay to new URL
- `webhook clear` - Clear history
- `webhook forward <url>` - Forward to another service
## Notes
The skill explicitly receives, inspects, and stores webhook requests locally, but it does not warn users that webhook payloads commonly contain secrets, personal data, tokens, or internal business events. Omitting this disclosure can cause users to capture and retain sensitive data unintentionally, increasing risk of local exposure, mishandling, or accidental sharing during debugging.
The skill supports replaying and forwarding captured webhook requests to arbitrary URLs, but it does not warn that this transmits previously captured payloads, headers, and possibly credentials to another destination. Users may unintentionally exfiltrate sensitive data to third-party or mistyped endpoints during debugging or testing.
No suspicious patterns detected.