Security audit

webhook-send

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward webhook message sender, but its broad triggers and lack of an explicit confirmation/privacy guard make accidental external posting a real review concern.

Install only if you trust and control WEBHOOK_SEND_URL and understand that message text or Markdown will be sent to that endpoint. Prefer tightening triggers to explicit webhook-send phrases and require a clear user confirmation before any POST, especially if the webhook posts into a shared group or business channel.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly documents that the skill will POST message content to a webhook endpoint taken from an environment variable, but it provides no warning that user-supplied content will leave the local system and be transmitted to an external service. In a messaging/notification skill, this omission can lead to accidental disclosure of sensitive data, especially if users assume the action is purely local or do not understand where the webhook points.

Natural-Language Policy Violations

Medium

Confidence: 74% confidence
Finding: All user-facing natural-language content in the manifest and documentation is written only in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale. Under the policy, a skill should not impose a language or locale without user opt-in or a clearly documented regional justification.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The manifest includes broad everyday triggers like '通知', '群组', and '机器人', which can cause the skill to activate for unrelated user requests. Because this skill sends outbound webhook messages, unintended invocation can lead to accidental message delivery to external systems and misuse of the configured webhook endpoint.

External Transmission

Medium

Category: Data Exfiltration
Content: --- ## curl 示例 ```bash # 替换 WEBHOOK_URL 为实际地址
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: SQP-3 applies to natural-language policy issues in any file type, including markdown. The file presents all instructions and examples only in Chinese and does not indicate that the user can choose another language, which may violate a language-choice policy if organizational guidance requires opt-in rather than a forced locale.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 86% confidence
Finding: The trigger '群组' is overly short and generic, making accidental activation likely when users discuss group chats or group notifications. Since the skill performs an external HTTP POST to a preconfigured webhook, unintended triggering can cause unauthorized or confusing outbound notifications.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 87% confidence
Finding: The trigger '通知' is a highly generic everyday term that could match many unrelated conversations about notifications. In a skill that emits external webhook POST requests, this increases the risk of accidental activation and unintended message transmission to third-party systems.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The file's natural-language instructions and examples are presented only in Chinese, which may amount to a language policy violation if users are not given an explicit language or locale choice. There is no indication that the document is intentionally region-specific or that an alternative language is available.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: This markdown file describes sending JSON payloads via POST to a webhook URL, which is a network operation that can transmit user or system data off-host. The document provides usage details and a curl example but does not include any warning or disclosure about the privacy or data-sharing implications of sending content to the webhook endpoint.

Static analysis

No suspicious patterns detected.