mobile-notifications-push
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard implementation patterns for React Native push notifications. No malicious patterns, obfuscation, or unauthorized data access were found.
- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for ingesting and processing data from notification payloads, which is an inherent attack surface for indirect prompt injection. 1. Ingestion points: Data is retrieved from notification.request.content.data (Expo) and remoteMessage.data (Firebase) in examples/core.md. 2. Boundary markers: The provided examples do not include explicit delimiters or 'ignore' instructions for the data payloads. 3. Capability inventory: The skill demonstrates using the data for screen navigation via a navigate function and for backend synchronization using fetch in examples/core.md. 4. Sanitization: No explicit sanitization or validation of the notification data is shown in the provided code snippets.
Audit Metadata