testland/webhook-delivery-tester
The single webhook-testing home, sender AND receiver: build-an-X for webhook delivery + receiver tests per Standard Webhooks (standardwebhooks.com) - HMAC-SHA256 signature verification, retry semantics with exponential backoff + jitter, replay-window check via timestamp tolerance, ordering guarantees, dead-letter handling for permanent failures, content-type + body-encoding fidelity - plus inbound capture-and-replay hardening (runtime-signed fixtures, tampered-payload and future-timestamp rejection, key-rotation acceptance, sanitized production captures) in references/inbound-replay.md. Use when authoring tests for webhook senders OR receivers in any system (Stripe / Twilio / SendGrid / GitHub / GitLab outbound webhooks; SaaS app inbound webhooks), including payment and realtime integrations.
75
94%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md and references/inbound-replay.md describe receiver-side webhook tests that ingest HTTP request bodies and headers (e.g., POST payloads to `/webhooks/...`) supplied at runtime, which an outsider could submit if they can POST into the workflow/endpoint being tested.
Where we found it
inbound webhook POST payloads (HTTP request bodies and headers)
content-type · 9 sites
The plugin's receiver-side test examples show code that processes inbound webhook POST payloads (bodies and headers) at webhook endpoints, and the capture-from-production section describes ingesting real production webhook payloads for replay testing.
- Audited
- Security analysis