webhook-bridge
Enables triggering Aeon skills via external events using GitHub Actions, enhancing automation and integration capabilities.
Install this skill
Security score
The webhook-bridge skill was audited on May 30, 2026 and we found 21 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 58 | ```yaml |
Webhook reference - potential data exfiltration
| 2 | name: webhook-bridge |
Webhook reference - potential data exfiltration
| 8 | # Webhook Bridge |
Webhook reference - potential data exfiltration
| 11 | `repository_dispatch` listener defined in `.github/workflows/webhook.yml`. |
Webhook reference - potential data exfiltration
| 16 | Actions workflow, a cron'd curl on a VPS, a DexScreener alert webhook proxy, |
Webhook reference - potential data exfiltration
| 18 | UI. Every Aeon skill is reachable as a webhook target. |
Webhook reference - potential data exfiltration
| 79 | ### Zapier (Webhooks by Zapier — POST) |
Webhook reference - potential data exfiltration
| 101 | ### DexScreener-style price-alert webhook proxy |
Webhook reference - potential data exfiltration
| 103 | Most webhook-producing services (DexScreener, BlockNative, etc.) post a JSON |
Webhook reference - potential data exfiltration
| 107 | 1. Validates the incoming webhook signature (each vendor has its own |
Webhook reference - potential data exfiltration
| 113 | secret — never embed it in the vendor's webhook config. |
Webhook reference - potential data exfiltration
| 144 | - It does not deduplicate dispatches. Two identical webhooks within one |
Webhook reference - potential data exfiltration
| 148 | ## Reactive triggers vs. webhook bridge |
Webhook reference - potential data exfiltration
| 153 | not external events. The webhook bridge is the *outside-in* path: external |
Webhook reference - potential data exfiltration
| 154 | systems trigger skills. The two compose — a webhook can fire `skill-repair` |
Webhook reference - potential data exfiltration
| 155 | externally, or a reactive trigger can fire after a webhook-dispatched skill |
Webhook reference - potential data exfiltration
| 181 | 4. Wire the production caller (Zapier zap, n8n flow, vendor webhook proxy). |
Webhook reference - potential data exfiltration
| 183 | That's the entire skill. The work happens in `webhook.yml`. |
External URL reference
| 27 | https://api.github.com/repos/{owner}/{repo}/dispatches \ |
External URL reference
| 81 | - URL: `https://api.github.com/repos/aaronjmars/aeon-agent/dispatches` |
External URL reference
| 95 | - URL: `https://api.github.com/repos/aaronjmars/aeon-agent/dispatches` |