fondo-webhooks-events
Enables event-driven financial workflows using webhooks from Stripe, Gusto, and Plaid for efficient financial management.
Install this skill
Security score
The fondo-webhooks-events skill was audited on May 17, 2026 and we found 23 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 53 | console.log(`Revenue: $${amount}`); |
Template literal with variable interpolation in command context
| 73 | console.log(`Payroll processed: $${totalPayroll}`); |
Template literal with variable interpolation in command context
| 76 | await sendAlert(`Payroll exceeded budget by ${((totalPayroll / monthlyPayrollBudget - 1) * 100).toFixed(0)}%`); |
Webhook reference - potential data exfiltration
| 2 | name: fondo-webhooks-events |
Webhook reference - potential data exfiltration
| 3 | description: 'Implement event-driven financial workflows using webhooks from Fondo-connected |
Webhook reference - potential data exfiltration
| 7 | Trigger: "fondo webhooks", "fondo events", "stripe payroll webhooks", "financial |
Webhook reference - potential data exfiltration
| 21 | # Fondo Webhooks & Events |
Webhook reference - potential data exfiltration
| 25 | Fondo itself does not send webhooks. Instead, build event-driven workflows using webhooks from the same providers Fondo connects to: Stripe (revenue), Gusto (payroll), Plaid (bank transactions), and M |
Webhook reference - potential data exfiltration
| 27 | ## Provider Webhooks |
Webhook reference - potential data exfiltration
| 38 | ### Stripe Revenue Webhook |
Webhook reference - potential data exfiltration
| 44 | app.post('/webhooks/stripe', express.raw({ type: '*/*' }), (req, res) => { |
Webhook reference - potential data exfiltration
| 46 | const event = stripe.webhooks.constructEvent( |
Webhook reference - potential data exfiltration
| 47 | req.body, sig, process.env.STRIPE_WEBHOOK_SECRET! |
Webhook reference - potential data exfiltration
| 64 | ### Gusto Payroll Webhook |
Webhook reference - potential data exfiltration
| 67 | // Gusto sends webhooks when payroll is processed |
Webhook reference - potential data exfiltration
| 68 | app.post('/webhooks/gusto', express.json(), async (req, res) => { |
Webhook reference - potential data exfiltration
| 85 | - [Stripe Webhooks](https://stripe.com/docs/webhooks) |
Webhook reference - potential data exfiltration
| 86 | - [Gusto Webhooks](https://docs.gusto.com/) |
Webhook reference - potential data exfiltration
| 87 | - [Plaid Webhooks](https://plaid.com/docs/api/webhooks/) |
Access to .env file
| 42 | const stripe = new Stripe(process.env.STRIPE_API_KEY!); |
Access to .env file
| 47 | req.body, sig, process.env.STRIPE_WEBHOOK_SECRET! |
External URL reference
| 85 | - [Stripe Webhooks](https://stripe.com/docs/webhooks) |
External URL reference
| 87 | - [Plaid Webhooks](https://plaid.com/docs/api/webhooks/) |