push-notification-tester
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Both push notification scripts include logic to automatically install dependencies via
npm installif thenode_modulesdirectory is missing. This is implemented using a hardcoded command string with no user input interpolation, which is a safe practice for environment setup.\n- [EXTERNAL_DOWNLOADS]: The skill relies on standard packages from the official NPM registry to handle APNs and FCM communications. These are well-known libraries appropriate for the skill's documented purpose.\n- [CREDENTIALS_UNSAFE]: While the skill requires access to sensitive files like private keys and service account JSONs, it correctly prompts the user for paths to these files rather than hardcoding credentials. The analysis shows these credentials are used locally to authenticate directly with trusted push notification gateways (Apple and Google).
Audit Metadata