webhooks

Facilitates the management and debugging of webhook integrations with various external services like GitHub and Stripe.

Install this skill

or

0/100

Security score

The webhooks skill was audited on May 12, 2026 and we found 58 security issues across 2 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 72

Curl to non-GitHub URL

SourceSKILL.md

72	curl -s http://localhost:3111/ \| jq .webhooks

medium line 83

Curl to non-GitHub URL

SourceSKILL.md

83	curl -X POST http://localhost:3111/webhooks/vercel \

medium line 117

Curl to non-GitHub URL

SourceSKILL.md

117	curl -X POST "https://api.vercel.com/v1/webhooks" \

medium line 2

Webhook reference - potential data exfiltration

SourceSKILL.md

2	name: webhooks

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	displayName: Webhooks

medium line 4

Webhook reference - potential data exfiltration

SourceSKILL.md

4	description: "Add, debug, and manage webhook providers in the joelclaw webhook gateway. Use when: adding a new webhook integration (GitHub, Stripe, Vercel, etc.), debugging webhook signature failures,

medium line 7

Webhook reference - potential data exfiltration

SourceSKILL.md

7	tags: [joelclaw, webhooks, integrations, signatures, inngest]

medium line 10

Webhook reference - potential data exfiltration

SourceSKILL.md

10	# Webhook Gateway Operations

medium line 12

Webhook reference - potential data exfiltration

SourceSKILL.md

12	Manage the joelclaw webhook gateway — add providers, debug delivery, register with external services.

low line 17

Webhook reference - potential data exfiltration

SourceSKILL.md

17	External Service → Tailscale Funnel :443 → Worker :3111 → /webhooks/:provider

medium line 21

Webhook reference - potential data exfiltration

SourceSKILL.md

21	- ADR-0048: Webhook Gateway for External Service Integration

medium line 28

Webhook reference - potential data exfiltration

SourceSKILL.md

28	\| todoist \| comment.added, task.completed, task.created \| HMAC-SHA256 (`x-todoist-hmac-sha256`) \| `https://panda.tail7af24.ts.net/webhooks/todoist` \|

medium line 29

Webhook reference - potential data exfiltration

SourceSKILL.md

29	\| front \| message.received, message.sent, assignee.changed \| HMAC-SHA1 (`x-front-signature`) \| `https://panda.tail7af24.ts.net/webhooks/front` \|

medium line 30

Webhook reference - potential data exfiltration

SourceSKILL.md

30	\| vercel \| deploy.succeeded, deploy.error, deploy.created, deploy.canceled \| HMAC-SHA1 (`x-vercel-signature`) \| `https://panda.tail7af24.ts.net/webhooks/vercel` \|

medium line 31

Webhook reference - potential data exfiltration

SourceSKILL.md

31	\| github \| workflow_run.completed, package.published \| HMAC-SHA256 (`x-hub-signature-256`) \| `https://panda.tail7af24.ts.net/webhooks/github` \|

medium line 33

Webhook reference - potential data exfiltration

SourceSKILL.md

33	Current ADR-0217 pilot note: when `QUEUE_PILOTS=github`, the webhook gateway enqueues normalized `github/workflow_run.completed` events into the shared Redis queue instead of posting them directly

medium line 40

Webhook reference - potential data exfiltration

SourceSKILL.md

40	1. Create `providers/{name}.ts` implementing `WebhookProvider` interface

medium line 44

Webhook reference - potential data exfiltration

SourceSKILL.md

44	5. Store webhook secret in `agent-secrets` → add lease to `start.sh`

medium line 46

Webhook reference - potential data exfiltration

SourceSKILL.md

46	7. Register webhook URL with external service

medium line 47

Webhook reference - potential data exfiltration

SourceSKILL.md

47	8. Verify E2E with `curl` + real webhook

medium line 53

Webhook reference - potential data exfiltration

SourceSKILL.md

53	\| `packages/system-bus/src/webhooks/types.ts` \| `WebhookProvider` interface, `NormalizedEvent` type \|

medium line 54

Webhook reference - potential data exfiltration

SourceSKILL.md

54	\| `packages/system-bus/src/webhooks/server.ts` \| Hono router — dispatches to providers, rate limiting \|

medium line 55

Webhook reference - potential data exfiltration

SourceSKILL.md

55	\| `packages/system-bus/src/webhooks/providers/` \| Provider implementations (one file per service) \|

medium line 60

Webhook reference - potential data exfiltration

SourceSKILL.md

60	\| `packages/system-bus/src/serve.ts` \| Worker role selection + health endpoint + webhook provider list \|

medium line 63

Webhook reference - potential data exfiltration

SourceSKILL.md

63	## Debugging Webhooks

medium line 65

Webhook reference - potential data exfiltration

SourceSKILL.md

65	### Check if webhook is arriving

low line 69

Webhook reference - potential data exfiltration

SourceSKILL.md

69	joelclaw logs worker --follow --grep webhook

low line 72

Webhook reference - potential data exfiltration

SourceSKILL.md

72	curl -s http://localhost:3111/ \| jq .webhooks

low line 73

Webhook reference - potential data exfiltration

SourceSKILL.md

73	# → { endpoint: "/webhooks/:provider", providers: ["todoist", "front", "vercel"] }

low line 80

Webhook reference - potential data exfiltration

SourceSKILL.md

80	SECRET="your-webhook-secret"

low line 81

Webhook reference - potential data exfiltration

SourceSKILL.md

81	BODY='{"type":"test-webhook","payload":{}}'

low line 83

Webhook reference - potential data exfiltration

SourceSKILL.md

83	curl -X POST http://localhost:3111/webhooks/vercel \

medium line 90

Webhook reference - potential data exfiltration

SourceSKILL.md

90	- Wrong secret — Todoist uses `client_secret` (not "Verification token"), Vercel uses the secret from webhook creation, Front uses the rules-based secret

medium line 109

Webhook reference - potential data exfiltration

SourceSKILL.md

109	## Registering Webhooks with Services

low line 114

Webhook reference - potential data exfiltration

SourceSKILL.md

114	# Via Vercel dashboard: Settings → Webhooks → Create

low line 117

Webhook reference - potential data exfiltration

SourceSKILL.md

117	curl -X POST "https://api.vercel.com/v1/webhooks" \

low line 121

Webhook reference - potential data exfiltration

SourceSKILL.md

121	"url": "https://panda.tail7af24.ts.net/webhooks/vercel",

medium line 126

Webhook reference - potential data exfiltration

SourceSKILL.md

126	The response includes a `secret` — store it: `secrets add vercel_webhook_secret --value "..."`

medium line 130

Webhook reference - potential data exfiltration

SourceSKILL.md

130	Set up via repo Settings → Webhooks:

medium line 131

Webhook reference - potential data exfiltration

SourceSKILL.md

131	- URL: `https://panda.tail7af24.ts.net/webhooks/github`

medium line 133

Webhook reference - potential data exfiltration

SourceSKILL.md

133	- Secret: generate one, store as `github_webhook_secret`

medium line 138

Webhook reference - potential data exfiltration

SourceSKILL.md

138	Already configured via Todoist App Console → Webhooks tab.

medium line 143

Webhook reference - potential data exfiltration

SourceSKILL.md

143	Already configured via Front Rules → "Trigger a webhook" action.

medium line 144

Webhook reference - potential data exfiltration

SourceSKILL.md

144	Rules webhooks scope to specific inboxes at the rule layer.

medium line 151

Webhook reference - potential data exfiltration

SourceSKILL.md

151	\| Front \| HMAC-SHA1 \| base64 (over compact JSON) \| `x-front-signature` \| Rules webhook secret \|

medium line 152

Webhook reference - potential data exfiltration

SourceSKILL.md

152	\| Vercel \| HMAC-SHA1 \| hex \| `x-vercel-signature` \| Webhook creation response \|

medium line 153

Webhook reference - potential data exfiltration

SourceSKILL.md

153	\| GitHub \| HMAC-SHA256 \| hex (prefixed `sha256=`) \| `x-hub-signature-256` \| Webhook config secret \|

medium line 160

Webhook reference - potential data exfiltration

SourceSKILL.md

160	- Vercel webhooks are Pro/Enterprise only — free plans cannot create account-level webhooks

medium line 161

Webhook reference - potential data exfiltration

SourceSKILL.md

161	- Front has TWO webhook types — App-level (SHA256, challenges) vs Rules-based (SHA1, no challenges). We use Rules-based

low line 28

External URL reference

SourceSKILL.md

28	\| todoist \| comment.added, task.completed, task.created \| HMAC-SHA256 (`x-todoist-hmac-sha256`) \| `https://panda.tail7af24.ts.net/webhooks/todoist` \|

low line 29

External URL reference

SourceSKILL.md

29	\| front \| message.received, message.sent, assignee.changed \| HMAC-SHA1 (`x-front-signature`) \| `https://panda.tail7af24.ts.net/webhooks/front` \|

low line 30

External URL reference

SourceSKILL.md

30	\| vercel \| deploy.succeeded, deploy.error, deploy.created, deploy.canceled \| HMAC-SHA1 (`x-vercel-signature`) \| `https://panda.tail7af24.ts.net/webhooks/vercel` \|

low line 31

External URL reference

SourceSKILL.md

31	\| github \| workflow_run.completed, package.published \| HMAC-SHA256 (`x-hub-signature-256`) \| `https://panda.tail7af24.ts.net/webhooks/github` \|

low line 72

External URL reference

SourceSKILL.md

72	curl -s http://localhost:3111/ \| jq .webhooks

low line 83

External URL reference

SourceSKILL.md

83	curl -X POST http://localhost:3111/webhooks/vercel \

low line 117

External URL reference

SourceSKILL.md

117	curl -X POST "https://api.vercel.com/v1/webhooks" \

low line 121

External URL reference

SourceSKILL.md

121	"url": "https://panda.tail7af24.ts.net/webhooks/vercel",

low line 131

External URL reference

SourceSKILL.md

131	- URL: `https://panda.tail7af24.ts.net/webhooks/github`

Scanned on May 12, 2026

View Security Dashboard

Installation guide →

GitHub Stars 46

Rate this skill

Categorydevelopment

UpdatedMay 21, 2026

frontend playwright stripe git api testing devops backend backend-developer devops-sre growth-pm github stripe vercel development product

joelhooks/joelclaw