📦
dead-code-detector
79Find Dead Code Before Cleanup
Unused code slows reviews and increases maintenance risk. This skill helps Claude, Codex, and Claude Code identify removal candidates with review guidance.
Coding & Development View
Skills webhook-tester
📦
webhook-tester
Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Test Webhooks With Local Tunnels
Webhook integrations are hard to debug when providers must reach a local service. This skill guides tunnel setup, request inspection, signature checks, replay, and retry testing.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "webhook-tester" from https://skillstore.io/skills/curiouslearner-webhook-tester.md and its manifest at https://skillstore.io/api/skills/curiouslearner-webhook-tester/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "webhook-tester". I need to test GitHub webhooks against my local development server.
Expected outcome:
- A local receiver setup plan for the selected port.
- Tunnel options with consent and cleanup notes.
- A checklist for headers, signature validation, and quick responses.
Using "webhook-tester". My Stripe webhook signature check fails during local testing.
Expected outcome:
- A diagnosis path for raw body parsing, webhook secret selection, and signature header handling.
- Provider-specific checks for test mode and endpoint configuration.
- Safe logging guidance that avoids exposing payment details.
Using "webhook-tester". I want to replay captured webhook events without leaking secrets.
Expected outcome:
A replay workflow that stores only redacted test payloads, restricts replay to local endpoints, and removes logs after testing.
Security Audit
High Riskv8 • 7/5/2026 Open versioned report
Most static command-execution alerts are Markdown fence or JavaScript template-literal false positives, and the environment-variable alerts show normal secret handling examples. The skill still has meaningful operational risk because it guides public tunnel exposure and demonstrates unredacted logging or storage of webhook data.
1
Files scanned
839
Lines analyzed
7
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Unredacted Webhook Request Logging
The guide logs complete request headers and bodies in multiple examples and also recommends logging all webhooks. Webhook requests can contain signatures, tokens, personal data, and payment details.
The examples explicitly print headers and bodies, and the best practices section says to log all webhooks. The risk is high because webhook payloads commonly include secrets or customer data.
Medium
Public Tunnel Exposure Requires Consent
The skill instructs users to expose localhost through ngrok, Cloudflare Tunnel, localtunnel, and VS Code forwarding. This is expected for webhook testing, but it can make local development services reachable from the internet.
The cited lines are direct tunnel setup instructions. The behavior is intentional, but exposing localhost changes the attack surface and requires explicit approval and cleanup.
Medium
Replay Storage Example Lacks Filename Validation
The replay example stores webhook records and later reads a file selected by filename without showing basename, normalization, or directory boundary checks. If copied into a tool with user-controlled filenames, it could read unintended files.
The example directly joins the storage directory and filename before reading the file. The impact depends on how callers supply filenames, so confidence is high but not absolute.
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Hardcoded URL
cloudflared tunnel --url http://localhost:3000
This command exposes localhost through a Cloudflare public tunnel. That is intended for webhook testing, but it creates real network exposure that should require explicit user consent.
Medium
Node.js fs operations
await fs.mkdir(this.storageDir, { recursive: true });
The storage example creates a directory for captured webhook data. This supports local debugging, but captured webhook storage needs clear location, permissions, and cleanup controls.
Medium
Node.js fs operations
await fs.writeFile(filepath, JSON.stringify(webhook, null, 2));
The example writes complete webhook records to disk. Webhook headers and bodies often contain secrets or personal data, so unredacted persistence is a real risk.
Medium
Node.js fs operations
const content = await fs.readFile(filepath, 'utf8');
The example reads a webhook record by joining a caller-provided filename with the storage directory. If reused without filename validation, it could read unintended files.
Low
Fetch API call
const response = await fetch(url, {
The retry helper posts payload data to a caller-supplied URL. This is expected webhook behavior, but it is real network egress if copied without endpoint controls.
Low
Hardcoded URL
# 1. Visit https://webhook.site
The skill recommends a public webhook inspection service. This is useful for testing, but sending real webhook payloads there could disclose sensitive headers or body data.
Low
Hardcoded URL
# 2. Get unique URL (e.g., https://webhook.site/abc-123)
The example uses a public webhook.site URL as an endpoint. It is user-directed, but real payloads sent to that URL would leave the local environment.
Risk Factors
⚙️ External commands (64)
SKILL.md:43-49 SKILL.md:49-56 SKILL.md:56-80 SKILL.md:80-83 SKILL.md:83-109 SKILL.md:109-112 SKILL.md:112-133 SKILL.md:133-137 SKILL.md:137-146 SKILL.md:146-150 SKILL.md:150-169 SKILL.md:169-173 SKILL.md:173-180 SKILL.md:180-186 SKILL.md:186-261 SKILL.md:261-274 SKILL.md:274-284 SKILL.md:284-285 SKILL.md:285-286 SKILL.md:286-287 SKILL.md:287-291 SKILL.md:291-297 SKILL.md:297-304 SKILL.md:304-306 SKILL.md:306-310 SKILL.md:310-374 SKILL.md:374-380 SKILL.md:380-392 SKILL.md:392-396 SKILL.md:396-410 SKILL.md:410-414 SKILL.md:414-467 SKILL.md:467-483 SKILL.md:483-501 SKILL.md:501-507 SKILL.md:507-533 SKILL.md:533-537 SKILL.md:537-554 SKILL.md:554-561 SKILL.md:561-565 SKILL.md:565-590 SKILL.md:590-596 SKILL.md:596-653 SKILL.md:653-659 SKILL.md:659-669 SKILL.md:669-687 SKILL.md:687-697 SKILL.md:697-703 SKILL.md:703-708 SKILL.md:708-734 SKILL.md:734-738 SKILL.md:738-740 SKILL.md:740-746 SKILL.md:746-753 SKILL.md:753-791 SKILL.md:791-795 SKILL.md:795-798 SKILL.md:798-802 SKILL.md:802-805 SKILL.md:805-809 SKILL.md:809-812 SKILL.md:812-816 SKILL.md:816-819 SKILL.md:819-823
🌐 Network access (13)
📁 Filesystem access (6)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/curiouslearner-webhook-tester/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/curiouslearner-webhook-tester?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/curiouslearner-webhook-tester?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/curiouslearner-webhook-tester/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/curiouslearner-webhook-tester.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CuriousLearner. (2026). webhook-tester security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/curiouslearner-webhook-tester/audits/8BibTeX citation
@techreport{curiouslearner-curiouslearner-webhook-tester-2026,
author = {CuriousLearner},
title = {webhook-tester security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/curiouslearner-webhook-tester/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "webhook-tester security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "CuriousLearner"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/curiouslearner-webhook-tester/audits/8"
identifiers:
- type: other
value: "skillstore:curiouslearner-webhook-tester:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
74
Spec Compliance
What You Can Build
Validate a Local Webhook Endpoint
Expose a local development server and confirm provider delivery, headers, payload shape, and response behavior.
Test Retry and Failure Handling
Simulate failed deliveries, retry attempts, and delayed success paths before a webhook integration goes live.
Review Webhook Security Controls
Check signature validation, replay resistance, secret handling, HTTPS use, and provider-specific verification requirements.
Try These Prompts
Set Up Basic Local Testing
Help me create a local webhook receiver for port 3000 and explain how to inspect incoming requests safely.
Expose a Local Endpoint
Guide me through exposing my local webhook endpoint with a tunnel, including what permissions and cleanup steps I should use.
Debug Signature Verification
Help me debug failing webhook signature verification for Stripe or GitHub using raw body handling and test secrets.
Design Replay and Retry Tests
Create a webhook replay and retry test plan that covers idempotency, redaction, storage cleanup, and failure simulation.
Best Practices
- Use disposable test secrets and stop public tunnels immediately after testing.
- Redact signatures, tokens, customer data, and payment fields before logging or storing requests.
- Verify signatures, idempotency, retry behavior, and replay protection before using real provider payloads.
Avoid
- Do not expose a production service through a public tunnel for routine debugging.
- Do not paste real customer, payment, or authentication payloads into public webhook tools.
- Do not keep webhook logs that contain secrets longer than the active test requires.
Frequently Asked Questions
Does this skill run a tunnel automatically?
No. It provides setup guidance and examples. Users should explicitly approve any tunnel command before running it.
Can I use it with Claude, Codex, and Claude Code?
Yes. The report lists support for Claude, Codex, and Claude Code workflows.
Is webhook.site safe for sensitive payloads?
Use it only with test data. Public webhook tools can receive headers and payloads that may contain sensitive information.
Does it cover signature verification?
Yes. It includes examples for GitHub, Stripe, Shopify, and common provider signature headers.
Can I copy the examples into production?
Treat them as development examples. Add redaction, validation, retention limits, access controls, and operational monitoring first.
What problems does it help debug?
It helps inspect delivery, headers, payload formats, invalid signatures, retries, replay behavior, and provider response handling.
Developer Details
Author
CuriousLearnerLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
02f077c174c5335e2f5d02ca15e77b70d9543e58
Maintenance freshness
7/18/2026
Usage
4 downloads · 181 views
File structure
📄 SKILL.md
More from CuriousLearner
View all📦
code-reviewer
78Review Code for Quality and Security
Code reviews can miss security, testing, and maintainability issues when reviewers lack time. This skill guides Claude, Codex, and Claude Code through a structured review with prioritized findings.
Coding & Development View
📦
refactor-assistant
78Refactor Code Safely with Structured Guidance
Refactoring can introduce bugs when changes are broad or poorly explained. This skill helps Claude, Codex, and Claude Code plan and apply safer incremental improvements.
Coding & Development View
📦
performance-profiler
78Profile Application Performance Bottlenecks
Slow code can hide inside algorithms, rendering, database queries, and bundles. This skill reviews source patterns and produces prioritized optimization guidance.
Coding & Development View
📦
log-analyzer
78Analyze Application Logs Faster
Log files hide service failures, error spikes, and slow requests. This skill turns raw logs into structured findings, timelines, and practical remediation guidance.
DevOps & Infrastructure View
📦
documentation-generator
78Generate Developer Documentation
Manual documentation updates are slow and often inconsistent with code behavior. This skill guides Claude, Codex, and Claude Code to draft docstrings, README sections, and API references from source context.
Documentation View
Related Skills
View all📦
terraform-skill
80Build Better Terraform Modules
by sickn33
Terraform projects often grow into inconsistent modules, unclear tests, and risky release workflows. This skill gives Claude, Codex, and Claude Code practical Terraform and OpenTofu patterns for safer infrastructure delivery.
DevOps & Infrastructure View
📦
systematic-debugging
81Debug Technical Failures Systematically
by Asmayaseen
Quick fixes often hide the real cause and create regressions. This skill structures investigation, hypothesis testing, implementation, and verification around collected evidence.
Coding & Development View
📦
debugger
80Debug Software Failures Systematically
by shubhamsaboo
Bugs waste engineering time when symptoms hide the real cause. This skill guides Claude, Codex, and Claude Code through structured investigation, hypothesis testing, fixes, and prevention.
Coding & Development View
📦
testing
85Build Reliable Test Automation
by 89jobrien
Weak tests slow releases and hide regressions. This skill guides test strategy, TDD, automation, coverage review, and Playwright web checks.
Coding & Development View
📦
debugging
84Debug Errors and Root Causes
by 89jobrien
Errors and incidents are hard to triage when evidence is spread across logs, stack traces, and services. This skill structures diagnosis, parses logs, identifies patterns, and guides minimal fixes.
Coding & Development View
📦
code-context-finder
83Find Code Context Faster
by 89jobrien
Developers often lose time tracing why code exists and what depends on it. This skill prompts Claude, Codex, or Claude Code to gather related graph knowledge, callers, imports, and tests before changes.
Coding & Development View