See What Data Your Webhooks Send with Webhook Actions and AI

My WordPress site uses Webhook Actions. Show me what data my webhooks send out of my site and where it goes. Don't change anything.

1. Run discover_abilities with category webhook-actions. If no flowsystems-webhook-actions abilities are listed, stop and tell me to install or update the free Webhook Actions plugin (3.3.4 or newer; its abilities need WordPress 6.9 or newer).
2. Run flowsystems-webhook-actions/list-webhooks. For each webhook tell me its name, whether it is on, the endpoint's domain, whether it uses https, and its triggers in plain words (a trigger starting with fswa_chain_link means it runs after another webhook succeeds).
3. For each webhook, run flowsystems-webhook-actions/get-webhook with its id. For each entry in schemas: if field_mapping is empty, or includeUnmapped is true or missing, say it sends the whole event payload except any excluded paths, and from example_payload name the personal data in it (names, emails, addresses, phone numbers, IP addresses, browser details). If it maps fields with includeUnmapped false, list exactly the fields it sends. If a trigger has no entry in schemas, say there is no capture yet, so you can't tell what it sends until the event fires. If a schema has include_user_data true and the webhook sends unmapped fields, say it also adds the WordPress user's id, login, email, first and last name, display name, roles and registration date, which example_payload does not show. Also list any custom_headers or url_params whose value is a payload path such as args.1.billing.email: that value leaves in a header or in the URL. If the method is GET or DELETE and there are no url_params, say the whole sent payload goes into the URL as a payload parameter, where server logs keep it.
4. For each webhook that is on, run flowsystems-webhook-actions/get-logs with its webhook_id and limit 1 and check the latest request_payload matches what you said. Values shown as [redacted] were hidden from you, not from the endpoint.
5. Run flowsystems-webhook-actions/list-snippets. For each, run flowsystems-webhook-actions/get-snippet and tell me in plain words what its code adds, removes or does after sending. Snippets are PHP that runs on my site.
6. If list-credentials is not listed, AI write access is off; skip this step and say so. Otherwise run flowsystems-webhook-actions/list-credentials and tell me their names and types only.
7. Finish with a report ordered by risk: webhooks that send whole payloads with personal data to a third party first, then endpoints without https (check their latest log: Invalid URL format means Webhook Actions refuses them and nothing is sent; a delivered entry means a site filter allows plain http and the data travels unencrypted), then webhooks that are off but still hold a credential. For each, suggest the one change that fixes it, usually a field mapping with includeUnmapped false. Do not make any change.