sendgrid-inbound
Facilitates receiving and parsing inbound emails via SendGrid's Inbound Parse Webhook, enhancing email-to-app workflows.
Install this skill
Security score
The sendgrid-inbound skill was audited on Feb 15, 2026 and we found 19 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 3 | description: Receive inbound emails via SendGrid Inbound Parse Webhook. Covers MX record setup, webhook configuration, payload parsing, attachment handling, and security best practices. Use when recei |
Webhook reference - potential data exfiltration
| 10 | SendGrid's **Inbound Parse Webhook** receives emails for a specific hostname/subdomain, parses the message, and POSTs it to your webhook as `multipart/form-data`. |
Webhook reference - potential data exfiltration
| 13 | - SendGrid **posts the full parsed email** (text/html/headers/attachments) directly to your webhook. |
Webhook reference - potential data exfiltration
| 14 | - There is **no official signature verification** for Inbound Parse (unlike SendGrid Event Webhook). You must secure the endpoint yourself. |
Webhook reference - potential data exfiltration
| 20 | # Check MX record and test webhook |
Webhook reference - potential data exfiltration
| 21 | ../scripts/verify-inbound-setup.sh parse.example.com https://webhook.example.com/parse |
Webhook reference - potential data exfiltration
| 28 | 3. **Handle the webhook**: parse `multipart/form-data`, read `text`, `html`, `headers`, and attachments. |
Webhook reference - potential data exfiltration
| 31 | ### Parse Webhook Payloads |
Webhook reference - potential data exfiltration
| 34 | node ../scripts/parse-webhook-payload.js < payload.txt |
Webhook reference - potential data exfiltration
| 58 | ## Webhook Payload (Multipart/Form-Data) |
Webhook reference - potential data exfiltration
| 83 | ## Decision: How to Secure Inbound Parse Webhook? |
Webhook reference - potential data exfiltration
| 96 | - Basic authentication on webhook URL |
Webhook reference - potential data exfiltration
| 111 | - **Require basic auth** on the webhook URL. |
Webhook reference - potential data exfiltration
| 125 | **Webhook not receiving emails:** |
Webhook reference - potential data exfiltration
| 126 | - Verify webhook URL is publicly accessible (test with curl) |
Webhook reference - potential data exfiltration
| 141 | **Unauthorized webhook access:** |
Webhook reference - potential data exfiltration
| 142 | - Add basic authentication to webhook URL |
Webhook reference - potential data exfiltration
| 150 | - [references/webhook-examples.md](references/webhook-examples.md) |
External URL reference
| 21 | ../scripts/verify-inbound-setup.sh parse.example.com https://webhook.example.com/parse |