T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:150- Finding
Unauthenticated Public Webhook Can Trigger Agent Actions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:150-169
Vulnerability Type: Missing webhook authentication and replay protection
Risk Level: HighVulnerable Code
markdown ## Webhook Integration (Inbound Events) Ringg AI can push real-time call events to OpenClaw via webhooks. To receive call status updates, transcripts, and dispositions: 1. Expose OpenClaw's webhook endpoint: ```bash ngrok http 18789-
Configure the webhook URL in Ringg AI dashboard or via API:
bash curl -X POST "https://api.ringg.ai/v1/webhooks" \ -H "Authorization: Bearer $RINGG_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "url": "https://your-ngrok-url.ngrok.io/webhook/ringg", "events": ["call.completed", "call.failed", "call.transcript_ready"] }' -
OpenClaw will receive POST payloads with call events that can trigger agent actions.
text The related API reference at `references/api_reference.md:248-258` describes the signing secret as optional: ```markdown ### Register WebhookPOST /webhooks
text **Body:** ```json { "url": "https://your-endpoint.example.com/webhook/ringg", "events": ["call.completed", "call.failed", "call.transcript_ready", "campaign.completed"], "secret": "optional-signing-secret" }text ### Technical Analysis The documented procedure exposes OpenClaw's local port through a public ngrok tunnel and states that received webhook events can trigger agent actions. However, the registration example omits a signing secret, while the API reference characterizes that secret as optional. The documentation also provides no requirement to verify a cryptographic signature over the raw request body before processing an event. No timestamp validation, event-ID deduplication, replay prevention, source authentication, strict payload schema, or identifier allowlisting is specified. Consequently, possession or discovery of the public endpoint URL may be sufficient to submit f ...[truncated 1592 chars]-
- Remediation
View remediation
Remediation Suggestions
- Require a cryptographically random webhook secret during registration; do not describe signing as optional.
- Verify the provider's signature over the exact raw HTTP request body before parsing or processing the payload.
- Use constant-time signature comparison and reject missing, malformed, or invalid signatures.
- Require a signed timestamp and enforce a narrow acceptance window to prevent stale-event replay.
- Persist processed event IDs and reject duplicates to provide idempotency and replay protection.
- Apply a strict schema to every event and allowlist accepted event types, call IDs, assistant IDs, and campaign IDs where feasible.
- Treat summaries, transcripts, dispositions, and other webhook fields as untrusted data rather than agent instructions.
- Ensure webhook events cannot directly invoke privileged tools without explicit authorization and policy checks.
- Rate-limit the endpoint, cap request sizes, log rejected requests, and alert on repeated authentication failures.
- Use temporary tunnel exposure only when necessary and add network-level access restrictions where supported.
- Update the documented registration example to include a secret and provide corresponding receiver-side verification instructions.