improve(dispatch-webhook): enforce HTTPS for non-local webhook URLs

2026-03-15 15:01:41 +08:00
parent 8bacc868bd
commit c0b7cf3415
2 changed files with 8 additions and 0 deletions
--- a/skills/dispatch-webhook/SKILL.md
+++ b/skills/dispatch-webhook/SKILL.md
@@ -112,3 +112,4 @@ Task ID: {task_id}
 | 401 Unauthorized | 立即失敗，提示設定 token |
 | 超時（> 30s） | 返回 accepted，等待 callback |
 | VPS 回傳 500 | 記錄錯誤，通知使用者 |
+| 非 HTTPS Webhook（且非 localhost/127.0.0.1） | 直接拒絕，避免 Bearer Token 明文傳輸 |