push-notification-tester
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Both
send-android-push.jsandsend-ios-push.jsautomatically install their own dependencies if they are missing from the local environment.\n - Evidence: Both scripts contain the logic
require('child_process').execSync('npm install --production', { cwd: __dirname, stdio: 'pipe' });to ensure the required packages are present.\n- [EXTERNAL_DOWNLOADS]: The skill downloads required packages from the official NPM registry and makes network requests to well-known service endpoints to send push notifications.\n - Evidence: The scripts interact with
https://fcm.googleapis.com/v1/projects/${args['project-id']}/messages:send(FCM) and the Apple APNs servers (via the@parse/node-apnlibrary).\n- [DATA_EXFILTRATION]: The scripts read local credential files provided by the user to authenticate push notification requests to legitimate third-party services.\n - Evidence:
send-android-push.jsreads a Firebase service account JSON file, andsend-ios-push.jsreads APNs certificates and private keys to establish authorized connections with push notification providers.
Audit Metadata