pushary-hermes

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill connects to https://pushary.com/api/mcp/sse to provide MCP server functionality. This connection targets the vendor's official service domain to deliver its primary notification and interaction features.
  • [INDIRECT_PROMPT_INJECTION]: The skill enables human-in-the-loop workflows by ingesting user responses via the ask_user tool.
  • Ingestion points: The value field returned by the ask_user tool in SKILL.md.
  • Boundary markers: None defined; instructions suggest developers rely on these responses for conditional logic (e.g., deploying code).
  • Capability inventory: The skill provides notification delivery, blocking question prompts, and response polling.
  • Sanitization: No explicit sanitization or validation of the user-provided response string is performed within the skill logic itself.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 07:27 PM
Security Audit — agent-trust-hub — pushary-hermes