auto-webhooks

Configures ADO service hooks and PR Review policies for automation agents using ADO REST API, enhancing CI/CD workflows.

Install this skill

or

0/100

Security score

The auto-webhooks skill was audited on Jun 14, 2026 and we found 65 security issues across 3 threat categories, including 1 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 164

Template literal with variable interpolation in command context

SourceSKILL.md

164

```bash

medium line 193

Template literal with variable interpolation in command context

SourceSKILL.md

193

```bash

high line 209

Template literal with variable interpolation in command context

SourceSKILL.md

209	Skip for consumer profile. Same mechanism as 2b/2c — the DoR agent (`ado-cli-dor.yml`, `/dx-dor`) gets a comment trigger: a comment containing `@kai-dor` on a User Story fires a Servic

medium line 220

Template literal with variable interpolation in command context

SourceSKILL.md

220

```bash

medium line 2

Webhook reference - potential data exfiltration

SourceSKILL.md

2	name: auto-webhooks

medium line 27

Webhook reference - potential data exfiltration

SourceSKILL.md

27	- For full-hub only: `webhooks.wi-userstory.url` (BugFix uses the Azure-native `webhooks.bugfix` comment hook — see 2c — not a WI-Router URL)

medium line 28

Webhook reference - potential data exfiltration

SourceSKILL.md

28	- Check if `webhooks.*.status` is already `configured` — skip if so

medium line 34

Webhook reference - potential data exfiltration

SourceSKILL.md

34	> Webhook username? (same as Lambda `BASIC_USER` set in hub's `/auto-lambda-env`)

medium line 36

Webhook reference - potential data exfiltration

SourceSKILL.md

36	> Webhook password? (same as Lambda `BASIC_PASS`) — secret, not stored

medium line 38

Webhook reference - potential data exfiltration

SourceSKILL.md

38	> Webhook secret? (same as Lambda `WEBHOOK_SECRET`) — secret, not stored

low line 86

Webhook reference - potential data exfiltration

SourceSKILL.md

86	\"consumerId\": \"webHooks\",

low line 97

Webhook reference - potential data exfiltration

SourceSKILL.md

97	\"httpHeaders\": \"x-webhook-secret:<WEBHOOK_SECRET>\"

medium line 104

Webhook reference - potential data exfiltration

SourceSKILL.md

104	- `webhooks.wi-userstory.subscriptionId` → returned ID

medium line 105

Webhook reference - potential data exfiltration

SourceSKILL.md

105	- `webhooks.wi-userstory.status` → `"configured"`

medium line 112

Webhook reference - potential data exfiltration

SourceSKILL.md

112	pipeline's Incoming WebHook — no Lambda, no tag hook. `bugfix` is intentionally

medium line 117

Webhook reference - potential data exfiltration

SourceSKILL.md

117	Skip for consumer profile. This is the only hook that does not route through a Lambda. SimpleAgent (`ado-cli-simple.yml`, `/dx-simple`) is triggered entirely inside ADO: a comment containing `

medium line 119

Webhook reference - potential data exfiltration

SourceSKILL.md

119	Prerequisite — Incoming WebHook service connection. Names are fixed to match `ado-cli-simple.yml` (and `ado-cli-simple-router.yml`):

medium line 120

Webhook reference - potential data exfiltration

SourceSKILL.md

120	- Webhook Name: `kai-simple` (matches the `webhook:` alias in the pipeline)

medium line 126

Webhook reference - potential data exfiltration

SourceSKILL.md

126	> Incoming WebHook secret? (optional — HMAC secret shared between the Service Hook and the Incoming WebHook connection. Leave blank for none.) — secret, not stored

low line 146

Webhook reference - potential data exfiltration

SourceSKILL.md

146	\"type\": \"incomingwebhook\",

low line 149

Webhook reference - potential data exfiltration

SourceSKILL.md

149	\"data\": { \"webhookName\": \"kai-simple\"<SECRET_FIELD> },

medium line 158

Webhook reference - potential data exfiltration

SourceSKILL.md

158	Where `<SECRET_FIELD>` is `, \"secret\": \"<webhook-secret>\"` when a secret was provided, or empty otherwise. `<PROJECT_ID>` is the GUID from step 0.

medium line 160

Webhook reference - potential data exfiltration

SourceSKILL.md

160	Fallback (UI): if the REST create is rejected (older ADO without the `incomingwebhook` endpoint type), create it manually: Project Settings → Service connections → New → Incoming WebHook, Webh

medium line 168

Webhook reference - potential data exfiltration

SourceSKILL.md

168	Create the Service Hook on the "Work item commented on" event, filtered so the comment contains `$TRIGGER_TOKEN`, delivering to the `kai-simple` Incoming WebHook (the pipeline's webhook resour

medium line 173

Webhook reference - potential data exfiltration

SourceSKILL.md

173	- Single-platform projects (default): point the hook at the `simple` pipeline's `kai-simple` Incoming WebHook, exactly as described above. The one dx-simple pipeline applies the change directl

medium line 174

Webhook reference - potential data exfiltration

SourceSKILL.md

174	- Multi-repo projects: point the hook at the `hub` (KAI-HUB router) Incoming WebHook (`ado-cli-hub.yml`) instead of `simple` directly. The hub parses the `@kai-<agent>` tag, runs `dx-discover-

medium line 177

Webhook reference - potential data exfiltration

SourceSKILL.md

177	- `webhooks.simple.connection` → `kai-simple-trigger-sc`

medium line 178

Webhook reference - potential data exfiltration

SourceSKILL.md

178	- `webhooks.simple.connectionId` → service connection ID (`$EXISTING_SC` or the created endpoint's `id`)

medium line 179

Webhook reference - potential data exfiltration

SourceSKILL.md

179	- `webhooks.simple.subscriptionId` → returned Service Hook ID

medium line 180

Webhook reference - potential data exfiltration

SourceSKILL.md

180	- `webhooks.simple.status` → `"configured"`

medium line 184

Webhook reference - potential data exfiltration

SourceSKILL.md

184	Skip for consumer profile. Identical mechanism to 2b (SimpleAgent) — the BugFix agent (`ado-cli-bug-fix.yml`, `/dx-bug-all`) is also fully Azure-native: a comment containing `@kai-bugfix` **on

medium line 186

Webhook reference - potential data exfiltration

SourceSKILL.md

186	Prerequisite — Incoming WebHook service connection (names match `ado-cli-bug-fix.yml`):

medium line 187

Webhook reference - potential data exfiltration

SourceSKILL.md

187	- Webhook Name: `bugfixHook` (matches the `webhook:` alias)

medium line 190

Webhook reference - potential data exfiltration

SourceSKILL.md

190	Create it exactly as in 2b (idempotent `az rest` GET → POST `incomingwebhook` endpoint), substituting `kai-bugfix-trigger-sc` / `bugfixHook` for the simple names. UI fallback is the same.

medium line 197

Webhook reference - potential data exfiltration

SourceSKILL.md

197	Create the Service Hook on "Work item commented on" with two filters — comment contains `$TRIGGER_TOKEN` AND Work Item Type = `Bug` (the pipeline's `resources.webhooks.filters` already enf

medium line 202

Webhook reference - potential data exfiltration

SourceSKILL.md

202	- `webhooks.bugfix.connection` → `kai-bugfix-trigger-sc`

medium line 203

Webhook reference - potential data exfiltration

SourceSKILL.md

203	- `webhooks.bugfix.connectionId` → service connection ID

medium line 204

Webhook reference - potential data exfiltration

SourceSKILL.md

204	- `webhooks.bugfix.subscriptionId` → returned Service Hook ID

medium line 205

Webhook reference - potential data exfiltration

SourceSKILL.md

205	- `webhooks.bugfix.status` → `"configured"`

medium line 209

Webhook reference - potential data exfiltration

SourceSKILL.md

209	Skip for consumer profile. Same mechanism as 2b/2c — the DoR agent (`ado-cli-dor.yml`, `/dx-dor`) gets a comment trigger: a comment containing `@kai-dor` on a User Story fires a Servic

medium line 213

Webhook reference - potential data exfiltration

SourceSKILL.md

213	Prerequisite — Incoming WebHook service connection (names match `ado-cli-dor.yml`):

medium line 214

Webhook reference - potential data exfiltration

SourceSKILL.md

214	- Webhook Name: `dorHook` (matches the `webhook:` alias)

medium line 217

Webhook reference - potential data exfiltration

SourceSKILL.md

217	Create it exactly as in 2b (idempotent `az rest` GET → POST `incomingwebhook` endpoint), substituting `kai-dor-trigger-sc` / `dorHook` for the simple names. UI fallback is the same.

medium line 224

Webhook reference - potential data exfiltration

SourceSKILL.md

224	Create the Service Hook on "Work item commented on" with two filters — comment contains `$TRIGGER_TOKEN` AND Work Item Type = `User Story` (the pipeline's `resources.webhooks.filters` alre

medium line 229

Webhook reference - potential data exfiltration

SourceSKILL.md

229	- `webhooks.dor.connection` → `kai-dor-trigger-sc`

medium line 230

Webhook reference - potential data exfiltration

SourceSKILL.md

230	- `webhooks.dor.connectionId` → service connection ID

medium line 231

Webhook reference - potential data exfiltration

SourceSKILL.md

231	- `webhooks.dor.subscriptionId` → returned Service Hook ID

medium line 232

Webhook reference - potential data exfiltration

SourceSKILL.md

232	- `webhooks.dor.status` → `"configured"`

low line 249

Webhook reference - potential data exfiltration

SourceSKILL.md

249	\"consumerId\": \"webHooks\",

low line 260

Webhook reference - potential data exfiltration

SourceSKILL.md

260	\"httpHeaders\": \"x-webhook-secret:<WEBHOOK_SECRET>\"

medium line 266

Webhook reference - potential data exfiltration

SourceSKILL.md

266	- `<pr-answer-url>` — for hub: from `webhooks.pr-answer.url` in infra.json. For consumer: the hub's PR Router Lambda URL (asked in step 0).

medium line 271

Webhook reference - potential data exfiltration

SourceSKILL.md

271	- `webhooks.pr-answer.subscriptionId` → returned ID

medium line 272

Webhook reference - potential data exfiltration

SourceSKILL.md

272	- `webhooks.pr-answer.status` → `"configured"`

medium line 311

Webhook reference - potential data exfiltration

SourceSKILL.md

311	- `webhooks.pr-review.policyId` → returned ID

medium line 312

Webhook reference - potential data exfiltration

SourceSKILL.md

312	- `webhooks.pr-review.status` → `"configured"`

low line 321

Webhook reference - potential data exfiltration

SourceSKILL.md

321	## ADO Webhooks Configured (Hub)

low line 327

Webhook reference - potential data exfiltration

SourceSKILL.md

327	\| SimpleAgent \| workitem.commented (comment contains @kai-simple) \| Project → pipeline Incoming WebHook (no Lambda) \| kai-simple-trigger-sc \| ✓ configured \|

low line 328

Webhook reference - potential data exfiltration

SourceSKILL.md

328	\| BugFix \| workitem.commented (comment contains @kai-bugfix, type Bug) \| Project → pipeline Incoming WebHook (no Lambda) \| kai-bugfix-trigger-sc \| ✓ configured \|

low line 329

Webhook reference - potential data exfiltration

SourceSKILL.md

329	\| DoR \| workitem.commented (comment contains @kai-dor, type User Story) \| Project → pipeline Incoming WebHook (no Lambda) \| kai-dor-trigger-sc \| ✓ configured \|

low line 348

Webhook reference - potential data exfiltration

SourceSKILL.md

348	## ADO Webhooks Configured (Consumer)

medium line 373

Webhook reference - potential data exfiltration

SourceSKILL.md

373	1. `/auto-webhooks` (hub project) — Creates 2 WI hooks (User Story + Bug, tag-filtered to `KAI-TRIGGER`) in the work-item ADO project (from scm.wiki-project config), 1 PR Answer hook scoped to the rep

medium line 375

Webhook reference - potential data exfiltration

SourceSKILL.md

375	2. `/auto-webhooks` (consumer project) — Skips WI hooks (managed by hub). Creates 1 PR Answer hook scoped to this repo + base branch pointing to the hub's Lambda URL, and 1 PR Review build validation

medium line 377

Webhook reference - potential data exfiltration

SourceSKILL.md

377	3. `/auto-webhooks` (re-run, hooks already exist) — Lists existing service hooks via `az rest`, detects that the PR Answer hook and PR Review policy already exist for this repo. Skips creation with "a

medium line 404

Webhook reference - potential data exfiltration

SourceSKILL.md

404	- Tag-based routing — all WI webhooks route to a single `/wi` endpoint. The WI Router Lambda scans work item tags against configured TAG_GATE_* env vars to determine which agent to invoke. No per-

low line 31

External URL reference

SourceSKILL.md

31	> Hub's PR Router Lambda URL? The API Gateway URL from the hub project's infra.json (e.g., `https://<id>.execute-api.us-east-1.amazonaws.com/prod/pr-answer`).

Scanned on Jun 14, 2026

View Security Dashboard

Installation guide →

GitHub Stars 6

Rate this skill

Categorydevelopment

UpdatedJune 15, 2026

frontend docx git api testing devops backend devops-sre backend-developer data-engineer azure github development

easingthemes/dx-aem-flow