automate-notifyer

Automates WhatsApp messaging with templates, AI bots, and analytics through the Notifyer by WhatsAble platform.

Install this skill

or

0/100

Security score

The automate-notifyer skill was audited on May 12, 2026 and we found 62 security issues across 2 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 7

Webhook reference - potential data exfiltration

SourceSKILL.md

7	message delivery logs, and manage developer webhooks (n8n / Make / Zapier integrations)

medium line 8

Webhook reference - potential data exfiltration

SourceSKILL.md

8	and IO webhooks (bidirectional incoming & outgoing). Use this skill after setup-notifyer

medium line 24

Webhook reference - potential data exfiltration

SourceSKILL.md

24	analytics, and webhooks — on a Notifyer account via the Console API (`https://api.insightssystem.com`).

medium line 121

Webhook reference - potential data exfiltration

SourceSKILL.md

121	### Webhooks

low line 124

Webhook reference - potential data exfiltration

SourceSKILL.md

124	node scripts/list-webhooks.js --type dev --pretty

low line 125

Webhook reference - potential data exfiltration

SourceSKILL.md

125	node scripts/list-webhooks.js --type io --pretty

low line 126

Webhook reference - potential data exfiltration

SourceSKILL.md

126	node scripts/create-webhook.js --url "https://hook.eu2.make.com/abc" --incoming --outgoing --signature

low line 127

Webhook reference - potential data exfiltration

SourceSKILL.md

127	node scripts/create-webhook.js --type io --url "https://myapp.com/wh" --signature

low line 128

Webhook reference - potential data exfiltration

SourceSKILL.md

128	node scripts/update-webhook.js --id 5 --status false # pause dev webhook

low line 129

Webhook reference - potential data exfiltration

SourceSKILL.md

129	node scripts/update-webhook.js --type io --id "abc" --url "https://new-url.com"

low line 130

Webhook reference - potential data exfiltration

SourceSKILL.md

130	node scripts/delete-webhook.js --id 5 --confirm

low line 131

Webhook reference - potential data exfiltration

SourceSKILL.md

131	node scripts/delete-webhook.js --type io --id "abc" --confirm

medium line 135

Webhook reference - potential data exfiltration

SourceSKILL.md

135	Dev webhook `id` is integer; IO webhook `id` is text UUID.

medium line 136

Webhook reference - potential data exfiltration

SourceSKILL.md

136	See `references/webhooks-reference.md` for full field reference and CORS/auth details.

medium line 273

Webhook reference - potential data exfiltration

SourceSKILL.md

273	### Webhooks

medium line 275

Webhook reference - potential data exfiltration

SourceSKILL.md

275	- Two distinct webhook systems — "Dev webhooks" (`zapier_make_webhooks` table) are for

medium line 276

Webhook reference - potential data exfiltration

SourceSKILL.md

276	outbound automation triggers to n8n, Make, or Zapier. "IO webhooks"

medium line 277

Webhook reference - potential data exfiltration

SourceSKILL.md

277	(`webhook_incoming_and_outgoing` table) are for bidirectional real-time data pipelines.

medium line 279

Webhook reference - potential data exfiltration

SourceSKILL.md

279	- Dev webhook endpoints ALL require `Origin: https://console.notifyer-systems.com` —

medium line 280

Webhook reference - potential data exfiltration

SourceSKILL.md

280	Xano runs `/cors_origin_console` as step 1 on every `/webhook/dev/*` endpoint. Scripts

medium line 282

Webhook reference - potential data exfiltration

SourceSKILL.md

282	- IO webhook endpoints do NOT require a CORS header — none of the `/user/io/webhook`

medium line 283

Webhook reference - potential data exfiltration

SourceSKILL.md

283	endpoints run `/cors_origin_console`. Do not add Origin header to IO webhook calls.

medium line 284

Webhook reference - potential data exfiltration

SourceSKILL.md

284	- Dev webhook id is integer; IO webhook id is TEXT — never cast an IO webhook id to

medium line 285

Webhook reference - potential data exfiltration

SourceSKILL.md

285	an integer. Store and pass it as a string. The `update-webhook.js` and `delete-webhook.js`

medium line 287

Webhook reference - potential data exfiltration

SourceSKILL.md

287	- Duplicate URL check (dev only) — `create-webhook.js --type dev` will return

medium line 288

Webhook reference - potential data exfiltration

SourceSKILL.md

288	`{ ok: false, blocked: true }` if a dev webhook with the same URL already exists

medium line 290

Webhook reference - potential data exfiltration

SourceSKILL.md

290	- `DELETE /webhook/dev/:id` is a PUBLIC ENDPOINT in Xano — Xano marks this endpoint

medium line 291

Webhook reference - potential data exfiltration

SourceSKILL.md

291	as Public with only a CORS check and no `/get_user` call. `delete-webhook.js` mitigates

medium line 292

Webhook reference - potential data exfiltration

SourceSKILL.md

292	this at the script level: it first calls `GET /webhook/dev` (fully authenticated) to list

medium line 293

Webhook reference - potential data exfiltration

SourceSKILL.md

293	the account's webhooks, then verifies the requested ID belongs to the authenticated account

medium line 294

Webhook reference - potential data exfiltration

SourceSKILL.md

294	before allowing the delete. An attacker with only a webhook ID but no valid token cannot

medium line 295

Webhook reference - potential data exfiltration

SourceSKILL.md

295	use this script to delete a webhook. The raw API endpoint itself remains unauthenticated —

medium line 297

Webhook reference - potential data exfiltration

SourceSKILL.md

297	- IO DELETE is fully authenticated — unlike dev webhook delete, IO webhook delete

medium line 298

Webhook reference - potential data exfiltration

SourceSKILL.md

298	(`DELETE /user/io/webhook`) does run `/get_user`. It is safe.

medium line 306

Webhook reference - potential data exfiltration

SourceSKILL.md

306	- IO PATCH `webhook` field is singular — the PATCH body for IO webhooks uses `webhook`

medium line 307

Webhook reference - potential data exfiltration

SourceSKILL.md

307	(singular) while the GET response field is named `webhooks` (plural). The `update-webhook.js`

medium line 310

Webhook reference - potential data exfiltration

SourceSKILL.md

310	`{ is_incomingOutgoing_active: bool }` globally enables/disables the IO webhook feature

medium line 311

Webhook reference - potential data exfiltration

SourceSKILL.md

311	for the account. Individual IO webhook `status` flags are independent of this global toggle.

medium line 312

Webhook reference - potential data exfiltration

SourceSKILL.md

312	Both must be true for an IO webhook to receive events.

medium line 316

Webhook reference - potential data exfiltration

SourceSKILL.md

316	- Update uses fetch-then-patch — both `update-webhook.js` types call the list endpoint

medium line 332

Webhook reference - potential data exfiltration

SourceSKILL.md

332	\| Developer/IO Webhooks \| `/api:qh9OQ3OW` \| Dev webhooks (Make/n8n/Zapier), IO webhooks, feature toggle, manual phone registration \|

medium line 358

Webhook reference - potential data exfiltration

SourceSKILL.md

358	\|\| `scripts/list-webhooks.js` \| `GET /api:qh9OQ3OW/webhook/dev` or `/user/io/webhook` — list dev or IO webhooks (--type dev\|io) \|

medium line 359

Webhook reference - potential data exfiltration

SourceSKILL.md

359	\|\| `scripts/create-webhook.js` \| `POST /webhook/dev/create` or `/user/io/webhook` — create a webhook with triggers, signature key, and status \|

medium line 360

Webhook reference - potential data exfiltration

SourceSKILL.md

360	\|\| `scripts/update-webhook.js` \| `PATCH /webhook/dev/:id` or `/user/io/webhook` — fetch-then-patch update for URL, status, triggers \|

medium line 361

Webhook reference - potential data exfiltration

SourceSKILL.md

361	\|\| `scripts/delete-webhook.js` \| `DELETE /webhook/dev/:id` or `/user/io/webhook` — permanent delete with --confirm safety gate \|

medium line 371

Webhook reference - potential data exfiltration

SourceSKILL.md

371	- `references/webhooks-reference.md` — Dev webhook and IO webhook full API reference: all endpoints, data types, CORS rules, id type differences, HMAC signature keys, feature toggle, manual phone regi

medium line 389

Webhook reference - potential data exfiltration

SourceSKILL.md

389	- IO webhook `id` is a text UUID, not an integer. Unlike dev webhook IDs. All IO webhook scripts handle this correctly — but external tools must treat the ID as a string.

medium line 390

Webhook reference - potential data exfiltration

SourceSKILL.md

390	- `DELETE /webhook/dev/:id` is a public endpoint in Xano (no server-side user auth check). `delete-webhook.js` adds an ownership verification step (authenticated `GET /webhook/dev` first) to block

medium line 391

Webhook reference - potential data exfiltration

SourceSKILL.md

391	- IO webhook global feature toggle has no dedicated script. `PATCH /api:qh9OQ3OW/user/incoming_outgoing/feature/status` (`{ is_incomingOutgoing_active: bool }`) globally enables or disables the IO

low line 400

Webhook reference - potential data exfiltration

SourceSKILL.md

400	\|\|references:{analytics-reference.md,bots-reference.md,broadcasts-reference.md,templates-reference.md,webhooks-reference.md}

low line 401

Webhook reference - potential data exfiltration

SourceSKILL.md

401	\|\|scripts:{create-bot.js,create-broadcast.js,create-template.js,create-webhook.js,delete-bot.js,delete-broadcast.js,delete-template.js,delete-webhook.js,get-bot.js,get-broadcast.js,get-message-analyti

low line 17

External URL reference

SourceSKILL.md

17	api-base: https://api.insightssystem.com

low line 24

External URL reference

SourceSKILL.md

24	analytics, and webhooks — on a Notifyer account via the Console API (`https://api.insightssystem.com`).

low line 41

External URL reference

SourceSKILL.md

41	export NOTIFYER_API_BASE_URL="https://api.insightssystem.com"

low line 57

External URL reference

SourceSKILL.md

57	--body "Check out our offer!" --type image --media-url "https://example.com/banner.jpg"

low line 126

External URL reference

SourceSKILL.md

126	node scripts/create-webhook.js --url "https://hook.eu2.make.com/abc" --incoming --outgoing --signature

low line 127

External URL reference

SourceSKILL.md

127	node scripts/create-webhook.js --type io --url "https://myapp.com/wh" --signature

low line 129

External URL reference

SourceSKILL.md

129	node scripts/update-webhook.js --type io --id "abc" --url "https://new-url.com"

low line 197

External URL reference

SourceSKILL.md

197	`POST https://api.openai.com/v1/assistants` before saving the bot. Both success and failure

low line 228

External URL reference

SourceSKILL.md

228	- Log endpoint requires CORS header — `GET /api:ereqLKj6/log` runs `/cors_origin_console` as its first step. `get-message-logs.js` sends `Origin: https://console.notifyer-systems.com` automaticall

low line 236

External URL reference

SourceSKILL.md

236	- All broadcast endpoints require `Origin: https://console.notifyer-systems.com` header —

low line 279

External URL reference

SourceSKILL.md

279	- Dev webhook endpoints ALL require `Origin: https://console.notifyer-systems.com` —

Scanned on May 12, 2026

View Security Dashboard

Installation guide →

GitHub Stars 2

Rate this skill

Categorysales

UpdatedMay 13, 2026

frontend remotion docx git api testing backend customer-success-manager growth-marketer social-media-manager marketing-analyst product-marketer whatsapp zapier make n8n sales marketing

Whatsable/whatsapp-business-agent-skills