postmark-webhooks

Facilitates the setup of Postmark webhooks for tracking email events like delivery, bounces, and opens, enhancing email marketing strategies.

Install this skill

or

0/100

Security score

The postmark-webhooks skill was audited on Mar 8, 2026 and we found 41 security issues across 3 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 77

Curl to non-GitHub URL

SourceSKILL.md

77	curl "https://api.postmarkapp.com/webhooks" \

medium line 2

Webhook reference - potential data exfiltration

SourceSKILL.md

2	name: postmark-webhooks

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	description: Use when setting up Postmark webhooks for tracking email delivery, bounces, opens, clicks, spam complaints, or subscription changes — includes webhook configuration, payload handling, and

medium line 10

Webhook reference - potential data exfiltration

SourceSKILL.md

10	# Postmark Webhooks

medium line 14

Webhook reference - potential data exfiltration

SourceSKILL.md

14	Postmark webhooks deliver real-time event data to your endpoint via HTTP POST. Use webhooks to track what happens after you send an email.

medium line 27

Webhook reference - potential data exfiltration

SourceSKILL.md

27	1. Create a webhook via API or [Postmark dashboard](https://account.postmarkapp.com) (Server → Webhooks)

medium line 33

Webhook reference - potential data exfiltration

SourceSKILL.md

33	## Webhook API

medium line 39

Webhook reference - potential data exfiltration

SourceSKILL.md

39	\| `/webhooks` \| `GET` \| List all webhooks for a message stream \|

medium line 40

Webhook reference - potential data exfiltration

SourceSKILL.md

40	\| `/webhooks/{webhookid}` \| `GET` \| Get a specific webhook \|

medium line 41

Webhook reference - potential data exfiltration

SourceSKILL.md

41	\| `/webhooks` \| `POST` \| Create a webhook \|

medium line 42

Webhook reference - potential data exfiltration

SourceSKILL.md

42	\| `/webhooks/{webhookid}` \| `PUT` \| Update a webhook \|

medium line 43

Webhook reference - potential data exfiltration

SourceSKILL.md

43	\| `/webhooks/{webhookid}` \| `DELETE` \| Delete a webhook \|

medium line 45

Webhook reference - potential data exfiltration

SourceSKILL.md

45	### Create a Webhook

low line 51

Webhook reference - potential data exfiltration

SourceSKILL.md

51	const webhook = await client.createWebhook({

low line 52

Webhook reference - potential data exfiltration

SourceSKILL.md

52	Url: 'https://yourdomain.com/webhooks/postmark',

low line 55

Webhook reference - potential data exfiltration

SourceSKILL.md

55	Username: 'webhook-user',

low line 56

Webhook reference - potential data exfiltration

SourceSKILL.md

56	Password: 'webhook-secret'

low line 71

Webhook reference - potential data exfiltration

SourceSKILL.md

71	console.log('Webhook created:', webhook.ID);

low line 77

Webhook reference - potential data exfiltration

SourceSKILL.md

77	curl "https://api.postmarkapp.com/webhooks" \

low line 83

Webhook reference - potential data exfiltration

SourceSKILL.md

83	"Url": "https://yourdomain.com/webhooks/postmark",

medium line 107

Webhook reference - potential data exfiltration

SourceSKILL.md

107	## Webhook Payloads

low line 112

Webhook reference - potential data exfiltration

SourceSKILL.md

112	app.post('/webhooks/postmark', (req, res) => {

medium line 150

Webhook reference - potential data exfiltration

SourceSKILL.md

150	Use the Bounces API and Suppression Management API alongside webhooks for comprehensive bounce handling.

medium line 154

Webhook reference - potential data exfiltration

SourceSKILL.md

154	## Webhook Management

medium line 156

Webhook reference - potential data exfiltration

SourceSKILL.md

156	See [references/webhook-setup.md](references/webhook-setup.md) for list, update, delete, and retry schedule details.

medium line 163

Webhook reference - potential data exfiltration

SourceSKILL.md

163	\| Slow webhook handling \| Respond 200 immediately, then process in background (queue, worker) \|

medium line 164

Webhook reference - potential data exfiltration

SourceSKILL.md

164	\| No authentication \| Use HTTP Basic Auth or custom headers to verify webhook source \|

medium line 167

Webhook reference - potential data exfiltration

SourceSKILL.md

167	\| Duplicate handling \| Webhooks may be delivered more than once — use `MessageID` for deduplication \|

medium line 168

Webhook reference - potential data exfiltration

SourceSKILL.md

168	\| Missing MessageStream filter \| Specify `MessageStream` when creating webhooks to avoid cross-stream events \|

medium line 169

Webhook reference - potential data exfiltration

SourceSKILL.md

169	\| Not tracking metadata \| Include `Metadata` when sending to correlate webhook events with your records \|

medium line 173

Webhook reference - potential data exfiltration

SourceSKILL.md

173	- Webhooks are configured per message stream — create separate webhooks for `outbound` and `broadcast`

medium line 174

Webhook reference - potential data exfiltration

SourceSKILL.md

174	- Always respond HTTP 200 immediately — process webhook data asynchronously

medium line 175

Webhook reference - potential data exfiltration

SourceSKILL.md

175	- Postmark retries failed webhook deliveries up to 10 times over ~10.5 hours with escalating intervals: 1 min, 5 min, 10 min, 10 min, 10 min, 15 min, 30 min, 1 hr, 2 hrs, 6 hrs. A 403 response

medium line 176

Webhook reference - potential data exfiltration

SourceSKILL.md

176	- Use `MessageID` to correlate webhook events with sent emails

medium line 177

Webhook reference - potential data exfiltration

SourceSKILL.md

177	- `Metadata` from the original send is included in all webhook payloads

medium line 180

Webhook reference - potential data exfiltration

SourceSKILL.md

180	- Bounce webhooks fire for bounces and blocks — check the `Type` field to distinguish

low line 49

Access to .env file

SourceSKILL.md

49	const client = new postmark.ServerClient(process.env.POSTMARK_SERVER_TOKEN);

low line 27

External URL reference

SourceSKILL.md

27	1. Create a webhook via API or [Postmark dashboard](https://account.postmarkapp.com) (Server → Webhooks)

low line 52

External URL reference

SourceSKILL.md

52	Url: 'https://yourdomain.com/webhooks/postmark',

low line 77

External URL reference

SourceSKILL.md

77	curl "https://api.postmarkapp.com/webhooks" \

low line 83

External URL reference

SourceSKILL.md

83	"Url": "https://yourdomain.com/webhooks/postmark",

Scanned on Mar 8, 2026

View Security Dashboard

Install this skill with one command

/learn @activecampaign/postmark-webhooks

GitHub Stars 30

Rate this skill

Categorymarketing

UpdatedMarch 29, 2026

openclaw api email-marketer growth-marketer marketing-analyst marketing

ActiveCampaign/postmark-skills