auto-webhooks
Configures ADO service hooks and PR Review policies for automation agents using ADO REST API, enhancing CI/CD workflows.
Install this skill
Security score
The auto-webhooks skill was audited on Apr 6, 2026 and we found 28 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 2 | name: auto-webhooks |
Webhook reference - potential data exfiltration
| 27 | - For **full-hub only**: `webhooks.wi-userstory.url`, `webhooks.wi-bug.url` |
Webhook reference - potential data exfiltration
| 28 | - Check if `webhooks.*.status` is already `configured` — skip if so |
Webhook reference - potential data exfiltration
| 34 | > **Webhook username?** (same as Lambda `BASIC_USER` set in hub's `/auto-lambda-env`) |
Webhook reference - potential data exfiltration
| 36 | > **Webhook password?** (same as Lambda `BASIC_PASS`) — secret, not stored |
Webhook reference - potential data exfiltration
| 38 | > **Webhook secret?** (same as Lambda `WEBHOOK_SECRET`) — secret, not stored |
Webhook reference - potential data exfiltration
| 86 | \"consumerId\": \"webHooks\", |
Webhook reference - potential data exfiltration
| 97 | \"httpHeaders\": \"x-webhook-secret:<WEBHOOK_SECRET>\" |
Webhook reference - potential data exfiltration
| 104 | - `webhooks.wi-userstory.subscriptionId` → returned ID |
Webhook reference - potential data exfiltration
| 105 | - `webhooks.wi-userstory.status` → `"configured"` |
Webhook reference - potential data exfiltration
| 122 | \"consumerId\": \"webHooks\", |
Webhook reference - potential data exfiltration
| 133 | \"httpHeaders\": \"x-webhook-secret:<WEBHOOK_SECRET>\" |
Webhook reference - potential data exfiltration
| 140 | - `webhooks.wi-bug.subscriptionId` → returned ID |
Webhook reference - potential data exfiltration
| 141 | - `webhooks.wi-bug.status` → `"configured"` |
Webhook reference - potential data exfiltration
| 158 | \"consumerId\": \"webHooks\", |
Webhook reference - potential data exfiltration
| 169 | \"httpHeaders\": \"x-webhook-secret:<WEBHOOK_SECRET>\" |
Webhook reference - potential data exfiltration
| 175 | - `<pr-answer-url>` — for hub: from `webhooks.pr-answer.url` in infra.json. For consumer: the hub's PR Router Lambda URL (asked in step 0). |
Webhook reference - potential data exfiltration
| 180 | - `webhooks.pr-answer.subscriptionId` → returned ID |
Webhook reference - potential data exfiltration
| 181 | - `webhooks.pr-answer.status` → `"configured"` |
Webhook reference - potential data exfiltration
| 220 | - `webhooks.pr-review.policyId` → returned ID |
Webhook reference - potential data exfiltration
| 221 | - `webhooks.pr-review.status` → `"configured"` |
Webhook reference - potential data exfiltration
| 230 | ## ADO Webhooks Configured (Hub) |
Webhook reference - potential data exfiltration
| 254 | ## ADO Webhooks Configured (Consumer) |
Webhook reference - potential data exfiltration
| 279 | 1. `/auto-webhooks` (hub project) — Creates 2 WI hooks (User Story + Bug, tag-filtered to `KAI-TRIGGER`) in the work-item ADO project (from scm.wiki-project config), 1 PR Answer hook scoped to the rep |
Webhook reference - potential data exfiltration
| 281 | 2. `/auto-webhooks` (consumer project) — Skips WI hooks (managed by hub). Creates 1 PR Answer hook scoped to this repo + base branch pointing to the hub's Lambda URL, and 1 PR Review build validation |
Webhook reference - potential data exfiltration
| 283 | 3. `/auto-webhooks` (re-run, hooks already exist) — Lists existing service hooks via `az rest`, detects that the PR Answer hook and PR Review policy already exist for this repo. Skips creation with "a |
Webhook reference - potential data exfiltration
| 310 | - **Tag-based routing** — all WI webhooks route to a single `/wi` endpoint. The WI Router Lambda scans work item tags against configured TAG_GATE_* env vars to determine which agent to invoke. No per- |
External URL reference
| 31 | > **Hub's PR Router Lambda URL?** The API Gateway URL from the hub project's infra.json (e.g., `https://<id>.execute-api.us-east-1.amazonaws.com/prod/pr-answer`). |