webhook-send

向指定 webhook 地址发送消息。URL 从环境变量 WEBHOOK_SEND_URL 读取。 仅支持 text、markdown 两种类型，支持 Markdown 富文本。

Security Scan

The skill's behavior (it reads a webhook URL from WEBHOOK_SEND_URL and posts messages) is simple and plausible, but the package metadata does not declare the required environment variable and there is a risk of sending secrets to an external endpoint — the mismatch and lack of explicit env var declaration are concerning.

Purpose & Capability

The SKILL.md explicitly says the webhook URL is read from the environment variable WEBHOOK_SEND_URL, but the registry metadata lists no required env vars and no primary credential. That mismatch is incoherent: a webhook-sending skill should declare WEBHOOK_SEND_URL as required so users know a secret/URL will be used.

Instruction Scope

Instructions are narrowly scoped: build a JSON body (text or markdown) and POST to the webhook URL using Content-Type: application/json. They do not instruct reading other files, system paths, or unrelated env vars. The only scope issue is that the SKILL.md relies on an env var not declared in the metadata.

Install Mechanism

Instruction-only skill with no install spec and no code files — lowest-risk installation footprint. Nothing is written to disk by an installer.

Credentials

The skill will use a webhook URL (likely containing secret tokens) from WEBHOOK_SEND_URL, but that env var is not declared in requires.env/primaryEnv. Requiring an undeclared secret is disproportionate from a metadata/transparency standpoint. Also, any webhook URL is an external endpoint: the skill will transmit whatever message body the agent constructs, so users should treat the URL as a secret and verify the destination before use.

Persistence & Privilege

always is false and the skill is user-invocable only; it does not request persistent/global agent privileges or modify other skills. Autonomous invocation is allowed by default but not combined with other high-risk factors here.

What to consider before installing

This skill performs simple POSTs to a webhook URL read from the environment. Before installing: 1) Expect to set WEBHOOK_SEND_URL (it is required by the instructions even though metadata doesn't list it) — ensure that URL points to a trusted endpoint and that any token in it is acceptable to share. 2) Don't put high-privilege credentials in that URL unless you trust the destination. 3) If you need stronger guarantees, ask the publisher to update the package metadata to declare WEBHOOK_SEND_URL as a required env var and to document exactly where data is sent. 4) Test in a safe environment (a disposable webhook receiver) to confirm behavior and rate/length limits before using in production. 5) If you see the skill asking for other env vars or reading system files, treat that as a red flag and avoid installing.

Webhook 发送消息

向指定 webhook 地址发起 HTTP POST，发送文本或 Markdown 消息。仅支持 text、markdown 两种类型。

何时使用

• 需要向 webhook 地址发送消息
• 需构造 text / markdown 请求体（URL 从 WEBHOOK_SEND_URL 读取）
• 询问群组通知、webhook 格式时

约定与限制

项	说明
URL	环境变量 WEBHOOK_SEND_URL（示例：https://xxx.com/api/v1/webhook/send?key=xxx）
方法	POST，Content-Type: application/json
频率	≤ 20 条/分钟
长度	单条 ≤ 5000 字符

消息类型

msgtype	说明	必填
text	纯文本	text.content
markdown	Markdown	markdown.text，支持标题/引用/加粗/颜色/列表/链接/图片等

请求体示例

text

{ "msgtype": "text", "text": { "content": "消息内容" } }

markdown（换行：\n\n 或 双空格+\n）

{ "msgtype": "markdown", "markdown": { "text": "## 标题\n\n内容" } }

更多示例见 reference.md。组好 body 后对 webhook URL 发 POST 即可。