push-notifications
Warn
Audited by Snyk on Apr 7, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The SKILL.md shows the app ingesting and acting on untrusted notification payloads (e.g., Android onMessageReceived uses data["type"]/data fields to drive behavior and iOS NotificationManager/NotificationService reads userInfo and downloads image_url in the Notification Service Extension), so third-party notification content/URLs can influence routing, actions, and displayed content.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata