service-integration

Facilitates seamless integration of external services and APIs, enhancing application functionality with email, CMS, and analytics solutions.

Install this skill

or

0/100

Security score

The service-integration skill was audited on Feb 28, 2026 and we found 72 security issues across 4 threat categories, including 2 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 236

Template literal with variable interpolation in command context

SourceSKILL.md

236	throw new Error(`Email send failed: ${error.message}`);

medium line 662

Template literal with variable interpolation in command context

SourceSKILL.md

662	console.log(`[Retry] Attempt ${attempt}/${maxAttempts} failed, retrying in ${delayMs}ms`); // Note: Use structured logger in production

medium line 748

Template literal with variable interpolation in command context

SourceSKILL.md

748	const id = `mock-${Date.now()}`;

medium line 823

Template literal with variable interpolation in command context

SourceSKILL.md

823	throw new Error(`Missing required environment variable: ${envVar}`);

medium line 898

Template literal with variable interpolation in command context

SourceSKILL.md

898	throw new Error(`Email send failed: ${error.message}`);

high line 969

Template literal with variable interpolation in command context

SourceSKILL.md

969	1. Verify API key is set: `printf "%s\n" "${RESEND_API_KEY:0:5}..."` (bash parameter expansion to display first 5 chars)

medium line 781

Curl to non-GitHub URL

SourceSKILL.md

781	if curl -X POST http://localhost:3000/api/webhooks/sanity \

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	description: "Load PROACTIVELY when task involves connecting external services or third-party APIs. Use when user says \"add email sending\", \"integrate a CMS\", \"set up file uploads\", \"add analyt

medium line 29

Webhook reference - potential data exfiltration

SourceSKILL.md

29	- Configure webhook endpoints for third-party services

low line 88

Webhook reference - potential data exfiltration

SourceSKILL.md

88	- id: webhook-routes

low line 90

Webhook reference - potential data exfiltration

SourceSKILL.md

90	patterns: ["src/app/api/webhooks/*/.ts", "pages/api/webhooks/*/.ts"]

medium line 391

Webhook reference - potential data exfiltration

SourceSKILL.md

391	### Step 4.3: Set Up Webhook Endpoint

medium line 393

Webhook reference - potential data exfiltration

SourceSKILL.md

393	For real-time content updates, implement a webhook handler:

low line 398

Webhook reference - potential data exfiltration

SourceSKILL.md

398	- path: "src/app/api/webhooks/sanity/route.ts"

low line 407

Webhook reference - potential data exfiltration

SourceSKILL.md

407	const signature = request.headers.get('sanity-webhook-signature');

low line 409

Webhook reference - potential data exfiltration

SourceSKILL.md

409	// Verify webhook signature

low line 410

Webhook reference - potential data exfiltration

SourceSKILL.md

410	const secret = process.env.SANITY_WEBHOOK_SECRET;

low line 412

Webhook reference - potential data exfiltration

SourceSKILL.md

412	return NextResponse.json({ error: 'Webhook secret not configured' }, { status: 500 });

low line 431

Webhook reference - potential data exfiltration

SourceSKILL.md

431	console.log('[Webhook] Sanity content updated:', _type); // Note: Use structured logger in production

low line 434

Webhook reference - potential data exfiltration

SourceSKILL.md

434	console.error('[Webhook] Failed to process Sanity webhook:', error);

low line 435

Webhook reference - potential data exfiltration

SourceSKILL.md

435	return NextResponse.json({ error: 'Webhook processing failed' }, { status: 500 });

medium line 764

Webhook reference - potential data exfiltration

SourceSKILL.md

764	### Step 8.2: Implement Webhook Testing

medium line 766

Webhook reference - potential data exfiltration

SourceSKILL.md

766	Test webhook handlers locally:

low line 771

Webhook reference - potential data exfiltration

SourceSKILL.md

771	- path: "scripts/test-webhook.sh"

low line 778

Webhook reference - potential data exfiltration

SourceSKILL.md

778	# Test Sanity webhook locally

low line 780

Webhook reference - potential data exfiltration

SourceSKILL.md

780	echo "[INFO] Testing Sanity webhook..."

low line 781

Webhook reference - potential data exfiltration

SourceSKILL.md

781	if curl -X POST http://localhost:3000/api/webhooks/sanity \

low line 783

Webhook reference - potential data exfiltration

SourceSKILL.md

783	-H "sanity-webhook-signature: $SANITY_WEBHOOK_SECRET" \

low line 789

Webhook reference - potential data exfiltration

SourceSKILL.md

789	echo "[PASS] Webhook test successful"

low line 791

Webhook reference - potential data exfiltration

SourceSKILL.md

791	echo "[FAIL] Webhook test failed"

medium line 932

Webhook reference - potential data exfiltration

SourceSKILL.md

932	### 4. Missing Webhook Verification

low line 947

Webhook reference - potential data exfiltration

SourceSKILL.md

947	const signature = request.headers.get('webhook-signature');

low line 949

Webhook reference - potential data exfiltration

SourceSKILL.md

949	// Validate webhook secret

low line 950

Webhook reference - potential data exfiltration

SourceSKILL.md

950	const secret = process.env.WEBHOOK_SECRET;

low line 952

Webhook reference - potential data exfiltration

SourceSKILL.md

952	return NextResponse.json({ error: 'Webhook secret not configured' }, { status: 500 });

medium line 977

Webhook reference - potential data exfiltration

SourceSKILL.md

977	1. Verify webhook endpoint is publicly accessible

medium line 978

Webhook reference - potential data exfiltration

SourceSKILL.md

978	2. Check webhook secret matches

medium line 979

Webhook reference - potential data exfiltration

SourceSKILL.md

979	3. Test webhook locally with ngrok

medium line 981

Webhook reference - potential data exfiltration

SourceSKILL.md

981	5. Check CMS webhook logs

medium line 1010

Webhook reference - potential data exfiltration

SourceSKILL.md

1010	- [ ] Webhook endpoints have signature verification

medium line 1023

Webhook reference - potential data exfiltration

SourceSKILL.md

1023	- [Webhook Best Practices](https://webhooks.fyi)

high line 979

Ngrok tunnel reference

SourceSKILL.md

979	3. Test webhook locally with ngrok

low line 82

Access to .env file

SourceSKILL.md

82	glob: ".env.example"

low line 208

Access to .env file

SourceSKILL.md

208	if (!process.env.RESEND_API_KEY) {

low line 212

Access to .env file

SourceSKILL.md

212	export const resend = new Resend(process.env.RESEND_API_KEY);

low line 320

Access to .env file

SourceSKILL.md

320	- path: ".env.example"

low line 355

Access to .env file

SourceSKILL.md

355	if (!process.env.NEXT_PUBLIC_SANITY_PROJECT_ID) {

low line 359

Access to .env file

SourceSKILL.md

359	if (!process.env.NEXT_PUBLIC_SANITY_DATASET) {

low line 364

Access to .env file

SourceSKILL.md

364	projectId: process.env.NEXT_PUBLIC_SANITY_PROJECT_ID,

low line 365

Access to .env file

SourceSKILL.md

365	dataset: process.env.NEXT_PUBLIC_SANITY_DATASET,

low line 367

Access to .env file

SourceSKILL.md

367	useCdn: process.env.NODE_ENV === 'production',

low line 410

Access to .env file

SourceSKILL.md

410	const secret = process.env.SANITY_WEBHOOK_SECRET;

low line 533

Access to .env file

SourceSKILL.md

533	if (!process.env.AWS_REGION \|\| !process.env.AWS_ACCESS_KEY_ID \|\| !process.env.AWS_SECRET_ACCESS_KEY \|\| !process.env.AWS_S3_BUCKET) {

low line 538

Access to .env file

SourceSKILL.md

538	region: process.env.AWS_REGION,

low line 540

Access to .env file

SourceSKILL.md

540	accessKeyId: process.env.AWS_ACCESS_KEY_ID,

low line 541

Access to .env file

SourceSKILL.md

541	secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,

low line 547

Access to .env file

SourceSKILL.md

547	Bucket: process.env.AWS_S3_BUCKET,

low line 590

Access to .env file

SourceSKILL.md

590	if (process.env.NEXT_PUBLIC_POSTHOG_KEY) {

low line 591

Access to .env file

SourceSKILL.md

591	posthog.init(process.env.NEXT_PUBLIC_POSTHOG_KEY, {

low line 592

Access to .env file

SourceSKILL.md

592	api_host: process.env.NEXT_PUBLIC_POSTHOG_HOST \|\| 'https://app.posthog.com',

low line 594

Access to .env file

SourceSKILL.md

594	if (process.env.NODE_ENV === 'development') {

low line 822

Access to .env file

SourceSKILL.md

822	if (!process.env[envVar]) {

low line 879

Access to .env file

SourceSKILL.md

879	if (!process.env.RESEND_API_KEY) {

low line 882

Access to .env file

SourceSKILL.md

882	const resend = new Resend(process.env.RESEND_API_KEY);

low line 950

Access to .env file

SourceSKILL.md

950	const secret = process.env.WEBHOOK_SECRET;

medium line 1008

Access to .env file

SourceSKILL.md

1008	- [ ] Environment variables documented in .env.example

low line 592

External URL reference

SourceSKILL.md

592	api_host: process.env.NEXT_PUBLIC_POSTHOG_HOST \|\| 'https://app.posthog.com',

low line 781

External URL reference

SourceSKILL.md

781	if curl -X POST http://localhost:3000/api/webhooks/sanity \

low line 1018

External URL reference

SourceSKILL.md

1018	- [Resend Documentation](https://resend.com/docs)

low line 1019

External URL reference

SourceSKILL.md

1019	- [Sanity Documentation](https://www.sanity.io/docs)

low line 1021

External URL reference

SourceSKILL.md

1021	- [PostHog Documentation](https://posthog.com/docs)

low line 1023

External URL reference

SourceSKILL.md

1023	- [Webhook Best Practices](https://webhooks.fyi)

Scanned on Feb 28, 2026

View Security Dashboard

Install this skill with one command

/learn @mgd34msu/service-integration

GitHub Stars 4

Rate this skill

Categorymarketing

UpdatedMarch 29, 2026

openclaw api backend email-marketer growth-marketer product-marketer backend-developer data-analyst sendgrid google-analytics plausible marketing development data analytics

mgd34msu/goodvibes-plugin