instantly-incident-runbook
Facilitates rapid incident response for Instantly outages, including triage, mitigation, and postmortem procedures.
Install this skill
Security score
The instantly-incident-runbook skill was audited on May 24, 2026 and we found 44 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 61 | console.log(`Unhealthy campaigns: ${unhealthy.length}`); |
Template literal with variable interpolation in command context
| 70 | console.log(`\nAccounts: ${accounts.length} total, ${healthy.length} healthy, ${broken.length} broken`); |
Template literal with variable interpolation in command context
| 75 | console.log(` ${v.email}: SMTP=${v.smtp_status} IMAP=${v.imap_status} DNS=${v.dns_status}`); |
Template literal with variable interpolation in command context
| 93 | console.log(`Paused broken account: ${v.email}`); |
Template literal with variable interpolation in command context
| 95 | console.log(`Failed to pause ${v.email}: ${e.message}`); |
Template literal with variable interpolation in command context
| 108 | console.log(` POST /accounts/${encodeURIComponent(v.email)}/resume`); |
Template literal with variable interpolation in command context
| 132 | console.log(`${campaign.name}: ${bounceRate}% bounce rate`); |
Template literal with variable interpolation in command context
| 133 | console.log(` Sent: ${analytics.emails_sent}, Bounced: ${analytics.emails_bounced}`); |
Template literal with variable interpolation in command context
| 141 | console.log(` Bounced leads: ${bouncedLeads.length} of ${leads.length} sampled`); |
Template literal with variable interpolation in command context
| 168 | console.log(`${w.name}: ${w.event_type} -> ${w.target_hook_url}`); |
Template literal with variable interpolation in command context
| 169 | console.log(` Status: ${w.status || "active"}`); |
Template literal with variable interpolation in command context
| 183 | console.log(`\nResuming paused webhook: ${w.name}`); |
Template literal with variable interpolation in command context
| 185 | await client.request(`/webhooks/${w.id}/resume`, { method: "POST" }); |
Template literal with variable interpolation in command context
| 189 | await client.request(`/webhooks/${w.id}/test`, { method: "POST" }); |
Template literal with variable interpolation in command context
| 192 | console.log(` Failed: ${e.message}`); |
Template literal with variable interpolation in command context
| 218 | console.log(`\nBackground jobs in progress: ${stuck.length}`); |
Template literal with variable interpolation in command context
| 220 | console.log(` ${j.id}: ${j.status} (created: ${j.timestamp_created})`); |
Template literal with variable interpolation in command context
| 256 | console.log(`${degraded.length} accounts with low warmup inbox rate:\n`); |
Template literal with variable interpolation in command context
| 259 | console.log(` ${w.email}: ${rate}% inbox rate (${w.warmup_emails_landed_spam} spam)`); |
Curl to non-GitHub URL
| 284 | curl -s https://api.instantly.ai/api/v2/campaigns?limit=100 \ |
Curl to non-GitHub URL
| 289 | EMAILS=$(curl -s https://api.instantly.ai/api/v2/accounts?limit=50 \ |
Curl to non-GitHub URL
| 294 | curl -s https://api.instantly.ai/api/v2/webhooks?limit=20 \ |
Webhook reference - potential data exfiltration
| 30 | Structured incident response procedures for Instantly.ai integration failures. Covers campaign pause cascades, account health crises, bounce protect triggers, webhook delivery failures, and API outage |
Webhook reference - potential data exfiltration
| 38 | | P3 Medium | Single campaign/account issue | 4 hours | One account SMTP failure, webhook delivery issue | |
Webhook reference - potential data exfiltration
| 156 | ## Incident: Webhook Delivery Failure |
Webhook reference - potential data exfiltration
| 161 | async function handleWebhookFailure() { |
Webhook reference - potential data exfiltration
| 162 | console.log("=== P3 TRIAGE: Webhook Delivery ===\n"); |
Webhook reference - potential data exfiltration
| 164 | // Check webhook status |
Webhook reference - potential data exfiltration
| 165 | const webhooks = await client.webhooks.list(); |
Webhook reference - potential data exfiltration
| 167 | for (const w of webhooks as any[]) { |
Webhook reference - potential data exfiltration
| 173 | const summary = await client.request("/webhook-events/summary"); |
Webhook reference - potential data exfiltration
| 177 | const byDate = await client.request("/webhook-events/summary-by-date"); |
Webhook reference - potential data exfiltration
| 180 | // Resume paused webhooks |
Webhook reference - potential data exfiltration
| 181 | for (const w of webhooks as any[]) { |
Webhook reference - potential data exfiltration
| 183 | console.log(`\nResuming paused webhook: ${w.name}`); |
Webhook reference - potential data exfiltration
| 185 | await client.request(`/webhooks/${w.id}/resume`, { method: "POST" }); |
Webhook reference - potential data exfiltration
| 189 | await client.request(`/webhooks/${w.id}/test`, { method: "POST" }); |
Webhook reference - potential data exfiltration
| 293 | echo "--- Webhooks ---" |
Webhook reference - potential data exfiltration
| 294 | curl -s https://api.instantly.ai/api/v2/webhooks?limit=20 \ |
External URL reference
| 284 | curl -s https://api.instantly.ai/api/v2/campaigns?limit=100 \ |
External URL reference
| 289 | EMAILS=$(curl -s https://api.instantly.ai/api/v2/accounts?limit=50 \ |
External URL reference
| 294 | curl -s https://api.instantly.ai/api/v2/webhooks?limit=20 \ |
External URL reference
| 309 | - [Instantly Help Center](https://help.instantly.ai) |
External URL reference
| 311 | - [Instantly Status Page](https://status.instantly.ai) |