configure-notifications
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
curlandjqto validate API connectivity, fetch user identifiers (e.g., Telegram chat IDs), and manage configuration files. Evidence includes usage ofcurlfor API requests andjqfor merging user-provided tokens into JSON config files. It also includes a feature for users to configure custom CLI commands that can be triggered by specific session events. - [CREDENTIALS_UNSAFE]: The skill facilitates the collection and local storage of sensitive credentials, including Telegram bot tokens, Discord bot tokens/webhooks, and Slack webhook URLs. These are saved to
~/.claude/.omc-config.jsonto enable notification functionality. Storing integration secrets in local configuration files is a standard and documented practice for this toolset. - [DATA_EXFILTRATION]: The skill transmits test messages and event notifications to external platforms including Telegram, Discord, and Slack via their official APIs. These network operations are core to the skill's purpose and target well-known, trusted service domains.
Audit Metadata