configure-notifications

Pass

Audited by Gen Agent Trust Hub on Apr 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands like curl and jq to validate API connectivity, fetch user identifiers (e.g., Telegram chat IDs), and manage configuration files. Evidence includes usage of curl for API requests and jq for merging user-provided tokens into JSON config files. It also includes a feature for users to configure custom CLI commands that can be triggered by specific session events.
  • [CREDENTIALS_UNSAFE]: The skill facilitates the collection and local storage of sensitive credentials, including Telegram bot tokens, Discord bot tokens/webhooks, and Slack webhook URLs. These are saved to ~/.claude/.omc-config.json to enable notification functionality. Storing integration secrets in local configuration files is a standard and documented practice for this toolset.
  • [DATA_EXFILTRATION]: The skill transmits test messages and event notifications to external platforms including Telegram, Discord, and Slack via their official APIs. These network operations are core to the skill's purpose and target well-known, trusted service domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 11, 2026, 09:20 AM