val-town
Enables instant deployment of server-side TypeScript functions for quick API endpoints, cron jobs, and webhook handling without infrastructure.
Install this skill
Security score
The val-town skill was audited on Mar 7, 2026 and we found 24 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 44 | return Response.json({ message: `Hello, ${name}!` }); |
Template literal with variable interpolation in command context
| 70 | text: `📊 Daily Report: ${stats.users} users, ${stats.revenue} revenue`, |
Fetch to external URL
| 63 | const response = await fetch("https://api.example.com/stats"); |
Fetch to external URL
| 133 | await fetch("https://api.myapp.com/activate", { |
Webhook reference - potential data exfiltration
| 6 | "quick API endpoint", "webhook handler", "cron job in the cloud", "Val Town", |
Webhook reference - potential data exfiltration
| 26 | - Need a quick API endpoint or webhook handler (minutes, not hours) |
Webhook reference - potential data exfiltration
| 29 | - Webhook receivers for Stripe, GitHub, Slack integrations |
Webhook reference - potential data exfiltration
| 67 | await fetch(Deno.env.get("SLACK_WEBHOOK")!, { |
Webhook reference - potential data exfiltration
| 116 | ### Webhook Handler |
Webhook reference - potential data exfiltration
| 119 | // @user/stripeWebhook — Handle Stripe webhooks |
Webhook reference - potential data exfiltration
| 124 | // Verify webhook signature |
Webhook reference - potential data exfiltration
| 126 | const secret = Deno.env.get("STRIPE_WEBHOOK_SECRET"); |
Webhook reference - potential data exfiltration
| 157 | ### Example 2: GitHub webhook to Slack |
Webhook reference - potential data exfiltration
| 161 | The agent will create an HTTP val that handles GitHub webhook events, filters for star events, and posts to a Slack webhook URL. |
Webhook reference - potential data exfiltration
| 173 | - **Not for production traffic** — great for webhooks, cron, prototypes; use proper infra for high-traffic APIs |
Access to .env file
| 67 | await fetch(Deno.env.get("SLACK_WEBHOOK")!, { |
Access to .env file
| 125 | // In Val Town, use Deno.env.get() for secrets |
Access to .env file
| 126 | const secret = Deno.env.get("STRIPE_WEBHOOK_SECRET"); |
Access to .env file
| 166 | - **Environment variables via `Deno.env.get()`** — store secrets in Val Town settings |
External URL reference
| 38 | // @user/myApi — Deployed instantly at https://user-myapi.web.val.run |
External URL reference
| 63 | const response = await fetch("https://api.example.com/stats"); |
External URL reference
| 80 | import { sqlite } from "https://esm.town/v/std/sqlite"; |
External URL reference
| 133 | await fetch("https://api.myapp.com/activate", { |
External URL reference
| 169 | - **Import from URLs** — `import { x } from "https://esm.town/v/user/module"` |
Install this skill with one command
/learn @terminalskills/val-town