Versioned security assessment

Report ID: SA-6A38A16C

6/28/2026, 8:16:07 PM

bark-notify security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
bark-notify
Version
v6
Maintainer
caopulan
Source
github.com/caopulan/Notification-Skill/tree/main/bark-notify
Coverage
2 Files scanned · 202 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

AI review did not confirm malicious intent or prompt injection. The critical static heuristic is explained by the skill purpose: it runs a local helper, reads notification configuration, and sends a Bark push request. Publish with a warning because task summaries and the Bark key can leave the local environment.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

2 Files scanned · 202 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 2 evidence locations

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 1 evidence location

Capability review items (2)
Medium
scripts/send_bark_notification.py:86-88scripts/send_bark_notification.py:118-119
Environment Variables Control Notification Credentials and Endpoint
TRUE POSITIVE with legitimate context. The script reads CODEX_MACHINE_NAME, CODEX_BARK_KEY, and CODEX_BARK_BASE_URL from the environment. This is normal configuration, but a changed base URL can redirect notification contents. Confidence: 0.78.
The environment access is explicit and necessary, while the base URL override creates a bounded but real data-routing risk.
Low
scripts/send_bark_notification.py:50-64scripts/send_bark_notification.py:107-115
Local Project Metadata Read From AGENTS.md
TRUE POSITIVE with low severity. The helper searches the current directory and parent directories for AGENTS.md and reads it to extract a project name. This is limited filesystem access and does not exfiltrate file contents except the derived project name in the notification body. Confidence: 0.82.
The file read is explicit and narrowly scoped to AGENTS.md, with only a parsed name included in the notification.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
scripts/send_bark_notification.py:109-119scripts/send_bark_notification.py:127-129
Task Summary Sent to External Push Service
TRUE POSITIVE. The helper builds a notification body from machine name, project name, status, and summary, then posts it to the Bark endpoint. This is the intended feature, but summaries can leak sensitive task details if the caller includes secrets. Confidence: 0.86.
The network request and payload construction are explicit, but the behavior is legitimate for a notification skill when users avoid sensitive content.
RISK-002 Medium
scripts/send_bark_notification.py:118-123
Dry Run Can Print Bark Key
TRUE POSITIVE. The Bark key is embedded in the URL path, and dry-run mode prints the full POST URL. Terminal logs or copied output could expose the notification token. Confidence: 0.93.
The code directly constructs the URL with CODEX_BARK_KEY and prints that URL during dry-run execution.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
SKILL.md:43-51
Documented Shell Command Invokes Local Helper Script
FALSE POSITIVE for command injection. The Markdown shows a fixed python3 command for the installed helper script with placeholder arguments. I did not find evidence of untrusted input being interpolated into a shell command by the skill code. Confidence: 0.95.
The flagged command text is documentation, and the Python script uses argparse rather than shell evaluation.
Low
SKILL.md:3scripts/send_bark_notification.py:73SKILL.md:45-51
Static Heuristic Findings Mostly Dismissed
FALSE POSITIVE. The weak cryptography detections point to descriptive text, not cryptographic code. The path traversal and hidden-file detections are Markdown examples for ~/.codex and placeholder ellipses, not runtime traversal logic. Confidence: 0.98.
The cited lines are human-readable descriptions or usage examples, and no weak cryptographic primitive or path traversal operation appears there.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable