send-notification
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the Bun runtime to execute a local TypeScript script (
pushover_core.ts) for notification delivery. It also uses a helper shell script (resolve_pushover_secret.sh) to retrieve credentials from secure local storage. - [DATA_EXFILTRATION]: The skill performs network requests to the Pushover API to deliver messages and images. This behavior is the primary intended function of the skill and does not involve unauthorized data transfer.
- [CREDENTIALS_UNSAFE]: The skill explicitly avoids hardcoded credentials, instead fetching them dynamically from 1Password or the macOS Keychain. This represents a security best practice for managing sensitive API tokens.
- [DATA_EXPOSURE]: The skill maintains a local audit log at
~/.local/state/pushover/po-audit.jsonl. Access to this file is restricted to the local user environment and is used for tracking notification history and quotas.
Audit Metadata