maui-push-notifications
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The documentation includes a sample
curlcommand designed for testing the backend API's functionality. This is a standard development practice for verifying endpoint connectivity and request structure. - [DATA_EXFILTRATION]: The skill implements a communication pipeline between a MAUI client, an ASP.NET Core backend, and Azure Notification Hubs. This architecture is the intended purpose of the skill and uses standard service providers (Microsoft, Google, and Apple) to route notification data.
- [PROMPT_INJECTION]: The skill processes user-supplied notification content (Title and Body) which is then interpolated into JSON payloads for Firebase (FCM) and Apple (APNS). While this creates an indirect prompt injection surface common to messaging services, it is inherent to the skill's primary function.
- Ingestion points: Data enters through the
/api/notifications/requestsPOST endpoint in the backend service. - Boundary markers: The code uses C# raw string literals for JSON construction but does not implement explicit delimiters or instruction-bypass warnings for the notification content.
- Capability inventory: The skill utilizes
NotificationHubClientto send payloads to external notification providers. - Sanitization: The provided sample code uses direct string interpolation; production implementations should ensure proper JSON escaping of the input strings to prevent payload malformation.
Audit Metadata