T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:150
- Finding
- Unauthenticated Public Webhook Can Trigger Agent Actions## Vulnerability Details **File Location**: `SKILL.md:150-169` **Vulnerability Type**: Missing webhook authentication and replay protection **Risk Level**: High ### Vulnerable Code ```markdown ## Webhook Integration (Inbound Events) Ringg AI can push real-time call events to OpenClaw via webhooks. To receive call status updates, transcripts, and dispositions: 1. Expose OpenClaw's webhook endpoint: ```bash ngrok http 18789 ``` 2. Configure the webhook URL in Ringg AI dashboard or via API: ```bash curl -X POST "https://api.ringg.ai/v1/webhooks" \ -H "Authorization: Bearer $RINGG_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "url": "https://your-ngrok-url.ngrok.io/webhook/ringg", "events": ["call.completed", "call.failed", "call.transcript_ready"] }' ``` 3. OpenClaw will receive POST payloads with call events that can trigger agent actions. ``` The related API reference at `references/api_reference.md:248-258` describes the signing secret as optional: ```markdown ### Register Webhook ``` POST /webhooks ``` **Body:** ```json { "url": "https://your-endpoint.example.com/webhook/ringg", "events": ["call.completed", "call.failed", "call.transcript_ready", "campaign.completed"], "secret": "optional-signing-secret" } ``` ``` ### Technical Analysis The documented procedure exposes OpenClaw's local port through a public ngrok tunnel and states that received webhook events can trigger agent actions. However, the registration example omits a signing secret, while the API reference characterizes that secret as optional. The documentation also provides no requirement to verify a cryptographic signature over the raw request body before processing an event. No timestamp validation, event-ID deduplication, replay prevention, source authentication, strict payload schema, or identifier allowlisting is specified. Consequently, possession or discovery of the public endpoint URL may be sufficient to submit f ...[truncated 1592 chars]
- Remediation
- ## Remediation Suggestions 1. Require a cryptographically random webhook secret during registration; do not describe signing as optional. 2. Verify the provider's signature over the exact raw HTTP request body before parsing or processing the payload. 3. Use constant-time signature comparison and reject missing, malformed, or invalid signatures. 4. Require a signed timestamp and enforce a narrow acceptance window to prevent stale-event replay. 5. Persist processed event IDs and reject duplicates to provide idempotency and replay protection. 6. Apply a strict schema to every event and allowlist accepted event types, call IDs, assistant IDs, and campaign IDs where feasible. 7. Treat summaries, transcripts, dispositions, and other webhook fields as untrusted data rather than agent instructions. 8. Ensure webhook events cannot directly invoke privileged tools without explicit authorization and policy checks. 9. Rate-limit the endpoint, cap request sizes, log rejected requests, and alert on repeated authentication failures. 10. Use temporary tunnel exposure only when necessary and add network-level access restrictions where supported. 11. Update the documented registration example to include a secret and provide corresponding receiver-side verification instructions.