webhook-automation

Event-driven webhook workflows with HMAC verification, retry logic, and multi-provider patterns. Use when: (1) receiving webhooks from GitHub, Stripe, Slack,...

This skill is internally coherent and implements what it claims, but before using it in production you should: (1) ensure you set a strong WEBHOOK_SECRET (do not leave it empty) and store it with restrictive file permissions; (2) update verify_signature to require a secret and fail closed (do not accept requests when no secret is configured); (3) adapt verification to each provider (Slack uses a timestamp + v0= HMAC scheme, GitHub expects sha256=...), and validate timestamps where applicable to prevent replay attacks; (4) avoid logging full payloads (logs can leak secrets or PII) or sanitize sensitive fields; (5) run the server behind TLS/HTTPS and/or a reverse proxy, bind to a restricted interface if you don't want public exposure, and use firewall rules; (6) populate the ROUTES mapping and add robust error handling and retry/backoff logic if you need guaranteed delivery; and (7) consider running this code in an isolated environment (container) and performing a code review before exposing it to public webhook traffic.

Type: OpenClaw Skill Name: webhook-automation Version: 1.0.0 The skill bundle provides a legitimate and well-documented framework for building webhook servers with security features like HMAC signature verification for GitHub, Stripe, and Slack. The Python scripts (webhook_server.py and handlers.py) follow standard practices for event routing and payload parsing, and the documentation in skill.md focuses on educational implementation rather than malicious exploitation. No evidence of data exfiltration, unauthorized remote execution, or harmful prompt injection was found.