技能 webhook-tester
📦

webhook-tester

内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量

使用本地隧道测试 Webhook

当提供商必须访问本地服务时，Webhook 集成很难调试。此技能会指导隧道设置、请求检查、签名校验、重放以及重试测试。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "webhook-tester" from https://skillstore.io/skills/curiouslearner-webhook-tester.md and its manifest at https://skillstore.io/api/skills/curiouslearner-webhook-tester/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/curiouslearner-webhook-tester.md 已签名 manifest GET /api/skills/curiouslearner-webhook-tester/manifest 已签名 lockfile GET /api/skills/curiouslearner-webhook-tester/lockfile

测试它

正在使用“webhook-tester”。 我需要针对本地开发服务器测试 GitHub Webhook。

预期结果:

  • 针对所选端口的本地接收器设置计划。
  • 包含同意确认和清理说明的隧道选项。
  • 用于 headers、签名验证和快速响应的检查清单。

正在使用“webhook-tester”。 我的 Stripe Webhook 签名检查在本地测试期间失败。

预期结果:

  • 针对 raw body 解析、Webhook secret 选择和签名 header 处理的诊断路径。
  • 针对测试模式和端点配置的提供商特定检查。
  • 避免暴露付款细节的安全日志记录指导。

正在使用“webhook-tester”。 我想重放捕获的 Webhook 事件，同时不泄露 secret。

预期结果:

一个重放工作流，仅存储已脱敏的测试 payload，将重放限制到本地端点，并在测试后删除日志。

安全审计

高风险
v8 • 2026/7/5 打开版本化报告

Most static command-execution alerts are Markdown fence or JavaScript template-literal false positives, and the environment-variable alerts show normal secret handling examples. The skill still has meaningful operational risk because it guides public tunnel exposure and demonstrates unredacted logging or storage of webhook data.

1
已扫描文件
839
分析行数
7
复核项
0
已忽略误报

已确认安全问题 (3)

高
SKILL.md:201-203SKILL.md:291-295SKILL.md:363-368SKILL.md:763
Unredacted Webhook Request Logging
The guide logs complete request headers and bodies in multiple examples and also recommends logging all webhooks. Webhook requests can contain signatures, tokens, personal data, and payment details.
The examples explicitly print headers and bodies, and the best practices section says to log all webhooks. The risk is high because webhook payloads commonly include secrets or customer data.
中
SKILL.md:66-79SKILL.md:142-145SKILL.md:154-158SKILL.md:173-179
Public Tunnel Exposure Requires Consent
The skill instructs users to expose localhost through ngrok, Cloudflare Tunnel, localtunnel, and VS Code forwarding. This is expected for webhook testing, but it can make local development services reachable from the internet.
The cited lines are direct tunnel setup instructions. The behavior is intentional, but exposing localhost changes the attack surface and requires explicit approval and cleanup.
中
SKILL.md:668-680
Replay Storage Example Lacks Filename Validation
The replay example stores webhook records and later reads a file selected by filename without showing basename, normalization, or directory boundary checks. If copied into a tool with user-controlled filenames, it could read unintended files.
The example directly joins the storage directory and filename before reading the file. The impact depends on how callers supply filenames, so confidence is high but not absolute.
能力复核项 (7)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中
SKILL.md:143
Hardcoded URL
cloudflared tunnel --url http://localhost:3000
This command exposes localhost through a Cloudflare public tunnel. That is intended for webhook testing, but it creates real network exposure that should require explicit user consent.
中
SKILL.md:672
Node.js fs operations
await fs.mkdir(this.storageDir, { recursive: true });
The storage example creates a directory for captured webhook data. This supports local debugging, but captured webhook storage needs clear location, permissions, and cleanup controls.
中
SKILL.md:673
Node.js fs operations
await fs.writeFile(filepath, JSON.stringify(webhook, null, 2));
The example writes complete webhook records to disk. Webhook headers and bodies often contain secrets or personal data, so unredacted persistence is a real risk.
中
SKILL.md:680
Node.js fs operations
const content = await fs.readFile(filepath, 'utf8');
The example reads a webhook record by joining a caller-provided filename with the storage directory. If reused without filename validation, it could read unintended files.
低
SKILL.md:724
Fetch API call
const response = await fetch(url, {
The retry helper posts payload data to a caller-supplied URL. This is expected webhook behavior, but it is real network egress if copied without endpoint controls.
低
SKILL.md:381
Hardcoded URL
# 1. Visit https://webhook.site
The skill recommends a public webhook inspection service. This is useful for testing, but sending real webhook payloads there could disclose sensitive headers or body data.
低
SKILL.md:382
Hardcoded URL
# 2. Get unique URL (e.g., https://webhook.site/abc-123)
The example uses a public webhook.site URL as an endpoint. It is user-directed, but real payloads sent to that URL would leave the local environment.

风险因素

⚙️ 外部命令 (64)
SKILL.md:43-49 SKILL.md:49-56 SKILL.md:56-80 SKILL.md:80-83 SKILL.md:83-109 SKILL.md:109-112 SKILL.md:112-133 SKILL.md:133-137 SKILL.md:137-146 SKILL.md:146-150 SKILL.md:150-169 SKILL.md:169-173 SKILL.md:173-180 SKILL.md:180-186 SKILL.md:186-261 SKILL.md:261-274 SKILL.md:274-284 SKILL.md:284-285 SKILL.md:285-286 SKILL.md:286-287 SKILL.md:287-291 SKILL.md:291-297 SKILL.md:297-304 SKILL.md:304-306 SKILL.md:306-310 SKILL.md:310-374 SKILL.md:374-380 SKILL.md:380-392 SKILL.md:392-396 SKILL.md:396-410 SKILL.md:410-414 SKILL.md:414-467 SKILL.md:467-483 SKILL.md:483-501 SKILL.md:501-507 SKILL.md:507-533 SKILL.md:533-537 SKILL.md:537-554 SKILL.md:554-561 SKILL.md:561-565 SKILL.md:565-590 SKILL.md:590-596 SKILL.md:596-653 SKILL.md:653-659 SKILL.md:659-669 SKILL.md:669-687 SKILL.md:687-697 SKILL.md:697-703 SKILL.md:703-708 SKILL.md:708-734 SKILL.md:734-738 SKILL.md:738-740 SKILL.md:740-746 SKILL.md:746-753 SKILL.md:753-791 SKILL.md:791-795 SKILL.md:795-798 SKILL.md:798-802 SKILL.md:802-805 SKILL.md:805-809 SKILL.md:809-812 SKILL.md:812-816 SKILL.md:816-819 SKILL.md:819-823
🌐 网络访问 (13)
SKILL.md:687 SKILL.md:724 SKILL.md:620 SKILL.md:632 SKILL.md:644 SKILL.md:449 SKILL.md:58 SKILL.md:143 SKILL.md:145 SKILL.md:381 SKILL.md:382 SKILL.md:483 SKILL.md:687
📁 文件系统访问 (6)
SKILL.md:672 SKILL.md:673 SKILL.md:680 SKILL.md:484 SKILL.md:84 SKILL.md:84
🔑 环境变量 (15)
SKILL.md:207 SKILL.md:249 SKILL.md:257 SKILL.md:302 SKILL.md:542 SKILL.md:582 SKILL.md:207 SKILL.md:249 SKILL.md:257 SKILL.md:302 SKILL.md:542 SKILL.md:582 SKILL.md:322 SKILL.md:322 SKILL.md:249
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/curiouslearner-webhook-tester/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/curiouslearner-webhook-tester/security.svg)](https://skillstore.io/skills/curiouslearner-webhook-tester?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/curiouslearner-webhook-tester?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/curiouslearner-webhook-tester/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/curiouslearner-webhook-tester.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

CuriousLearner. (2026). webhook-tester security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/curiouslearner-webhook-tester/audits/8

BibTeX 引用

@techreport{curiouslearner-curiouslearner-webhook-tester-2026, author = {CuriousLearner}, title = {webhook-tester security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/curiouslearner-webhook-tester/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "webhook-tester security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "CuriousLearner" date-released: "2026-07-05" url: "https://skillstore.io/skills/curiouslearner-webhook-tester/audits/8" identifiers: - type: other value: "skillstore:curiouslearner-webhook-tester:audit:8" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
70
社区
74
规范符合性

你能构建什么

验证本地 Webhook 端点

暴露本地开发服务器，并确认提供商投递、headers、payload 结构和响应行为。

测试重试和故障处理

在 Webhook 集成上线前，模拟投递失败、重试尝试和延迟成功路径。

审查 Webhook 安全控制

检查签名验证、重放防护、secret 处理、HTTPS 使用以及提供商特定的验证要求。

试试这些提示

设置基础本地测试 
帮我为端口 3000 创建一个本地 Webhook 接收器，并解释如何安全地检查传入请求。
暴露本地端点 
指导我通过隧道暴露本地 Webhook 端点，包括我应使用哪些权限和清理步骤。
调试签名验证 
帮我使用 raw body 处理和测试 secret 调试 Stripe 或 GitHub 的 Webhook 签名验证失败问题。
设计重放和重试测试 
创建一个 Webhook 重放和重试测试计划，覆盖幂等性、脱敏、存储清理和故障模拟。

最佳实践

  • 使用一次性测试 secret，并在测试后立即停止公开隧道。
  • 在记录或存储请求前，脱敏签名、token、客户数据和付款字段。
  • 在使用真实提供商 payload 前，验证签名、幂等性、重试行为和重放保护。

避免

  • 不要为了日常调试而通过公开隧道暴露生产服务。
  • 不要将真实客户、付款或认证 payload 粘贴到公开 Webhook 工具中。
  • 不要将包含 secret 的 Webhook 日志保留得比当前测试所需时间更久。

常见问题

此技能会自动运行隧道吗？
不会。它提供设置指导和示例。用户应在运行任何隧道命令前明确批准。
我可以将它用于 Claude、Codex 和 Claude Code 吗？
可以。报告列出了对 Claude、Codex 和 Claude Code 工作流的支持。
webhook.site 对敏感 payload 安全吗？
仅将其用于测试数据。公开 Webhook 工具可能会接收包含敏感信息的 headers 和 payload。
它涵盖签名验证吗？
涵盖。它包含 GitHub、Stripe、Shopify 以及常见提供商签名 headers 的示例。
我可以将示例复制到生产环境吗？
应将它们视为开发示例。先添加脱敏、验证、保留期限、访问控制和运营监控。
它能帮助调试哪些问题？
它有助于检查投递、headers、payload 格式、无效签名、重试、重放行为和提供商响应处理。

开发者详情

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/CuriousLearner/devkit/tree/main/skills/webhook-tester

引用

02f077c174c5335e2f5d02ca15e77b70d9543e58

维护新鲜度

2026/7/18

使用量

4 次下载 · 181 次浏览

文件结构

📄 SKILL.md

CuriousLearner 的更多技能

查看全部

相关技能

查看全部