verbatim-audit-notify
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. The skill's implementation aligns with its stated purpose of providing an audited notification system.\n- [COMMAND_EXECUTION]: The skill includes several bash scripts (pushover-notify.sh, pushover-lookup.sh, etc.) for local execution. These scripts use jq for safe JSON manipulation and printf for formatted output, effectively preventing command injection.\n- [EXTERNAL_DOWNLOADS]: The scripts interact with the official Pushover API (api.pushover.net) to send messages and check quotas. These interactions are legitimate and necessary for functionality.\n- [SAFE]: Sensitive credentials (Pushover tokens) are retrieved from 1Password using the op CLI. This avoids hardcoding secrets and follows security best practices.\n- [SAFE]: The skill utilizes standard macOS launchd agents for automated tasks, which is an appropriate and documented use of persistence for user-level background jobs.
Audit Metadata