onesignal
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill is an educational and instructional resource for using a well-known third-party messaging service.
- [CREDENTIALS_UNSAFE]: The skill proactively warns against hardcoding or exposing sensitive credentials such as REST API keys, App IDs, and push certificates (.p8, .p12). It correctly instructs users to keep these keys on the server and use environment variables for secret management.
- [REMOTE_CODE_EXECUTION]: Instructions for package installation (e.g.,
npm install @onesignal/node-onesignal) and SDK usage are for official, verified libraries on standard registries. - [EXTERNAL_DOWNLOADS]: External references target official OneSignal domains (
cdn.onesignal.com) and their public GitHub repositories. These are well-known technology service providers and are considered safe sources. - [PROMPT_INJECTION]: The text references "system prompts" exclusively in the context of native operating system permission dialogs for notifications (iOS, Android, and Web browsers). These are technical descriptions of legitimate OS behavior and do not constitute attempts to manipulate the AI's instructions.
Audit Metadata