The Agent Skills Directory

[SAFE]: The skill codebase does not contain any malicious patterns or behaviors. It is architected with a strong focus on security, providing comprehensive templates and rules for handling push notifications safely.
[SAFE]: An integrated security verification tool (check-push.mjs) is provided to automatically detect common vulnerabilities in implementation, such as the accidental inclusion of APNs keys, Google service account credentials, or insecure client-side push-sending logic.
[SAFE]: Mock credential files (e.g., in tests/bases/app/.agents/skills/planted/sa.json) and intentional policy violations found in the test directories are isolated fixtures used solely for verifying the skill's built-in security auditor and are not used in production.
[INDIRECT_PROMPT_INJECTION]: The skill defines a clear ingestion surface for external data via push notification payloads. This surface is mitigated as follows:
Ingestion points: Untrusted external data enters the agent context through PushResponse.data in templates/src/services/push/push-tap-router.ts.
Boundary markers: The skill architecture mandates the use of strict valibot schemas for data parsing, as seen in templates/src/core/push/push-message.ts.
Capability inventory: Navigational capabilities are restricted to a predefined mapping of internal destination objects in templates/src/core/push/push-destination.ts, which prevents the execution of arbitrary routes, URLs, or commands from payload data.
Sanitization: Payload identifiers are strictly validated against regex patterns for short, opaque strings to prevent any injection or path traversal attempts.

push-notifications