push-notifications
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill guides users to integrate the OneSignal SDK from a well-known service domain (cdn.onesignal.com) and utilizes the standard 'web-push' library for managing VAPID-based delivery.
- [INDIRECT_PROMPT_INJECTION]: The skill implementation includes an ingestion surface for external data payloads to be displayed via browser notifications.
- Ingestion points: Data is received via the
pushevent in the service worker (sw.js) and parsed usingevent.data.json(). - Boundary markers: None are present in the basic code templates provided.
- Capability inventory: The skill uses
self.registration.showNotificationto render remote content andclients.openWindowto navigate to remote URLs. - Sanitization: No specific sanitization logic is included in the provided service worker example.
Audit Metadata