web-push-notifications
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill focuses on secure implementation of Web Push protocols (RFC 8030, 8291, 8292).
- [EXTERNAL_DOWNLOADS]: The skill references official endpoints for well-known services including Google FCM (fcm.googleapis.com), Mozilla Autopush (updates.push.services.mozilla.com), Apple Push (web.push.apple.com), and Windows Notification Service (*.notify.windows.com) for their intended purpose in the Web Push lifecycle.
- [INDIRECT_PROMPT_INJECTION]: The skill documents how to handle external data from push subscriptions. It includes sanitization practices such as endpoint host allowlisting and payload size limits to mitigate common attack vectors like SSRF.
Audit Metadata