The Agent Skills Directory

[SAFE]: The skill provides technical instructions and code snippets for implementing Web Push notifications. The code follows industry-standard patterns for Service Workers, the Push API, and VAPID authentication.
[CREDENTIALS_UNSAFE]: The skill refers to sensitive credentials like VAPID_PRIVATE_KEY and COMETCHAT_WEBHOOK_SECRET. It correctly instructs the user to store these in server-side environment variables and explicitly warns against shipping the private key to the client, which is a security best practice.
[COMMAND_EXECUTION]: The skill suggests using npx web-push generate-vapid-keys to generate cryptographic keys. This is a standard and safe procedure for setting up Web Push services.
[DATA_EXFILTRATION]: Network operations via fetch are used to register push subscriptions with the user's own application server. This is the intended functionality and does not involve exfiltrating data to unauthorized third parties.
[INDIRECT_PROMPT_INJECTION]: The skill defines a data ingestion surface where a Service Worker processes push payloads and a server processes CometChat webhooks.
Ingestion points: sw.js (push event listener) and server/push.ts (webhook endpoint).
Boundary markers: The skill includes explicit instructions for HMAC SHA256 signature verification to authenticate incoming webhook data from CometChat.
Capability inventory: The code facilitates notification display and client-side navigation; it does not grant the agent high-privilege capabilities.
Sanitization: The skill demonstrates basic data handling such as truncating message previews before display.

cometchat-react-push