Skills push-notifications

📦

push-notifications

Name: push-notifications
Author: lc700x

v1.0.0 Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🌐 Network access

Get Push Alerts When Coding Agents Finish

Long coding tasks can finish while you are away from the computer. This skill sends ntfy mobile alerts and optional local sounds.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "push-notifications" from https://skillstore.io/skills/lc700x-push-notifications.md and its manifest at https://skillstore.io/api/skills/lc700x-push-notifications/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/lc700x-push-notifications.md Signed manifest GET /api/skills/lc700x-push-notifications/manifest Signed lockfile GET /api/skills/lc700x-push-notifications/lockfile

Test it

Using "push-notifications". Set up alerts for Claude Code on macOS.

Expected outcome:

Platform detected: macOS.
A protected ntfy topic was created.
The Claude Code Stop hook is ready for approval.

Using "push-notifications". Show notification status.

Expected outcome:

Push notifications are enabled.
Claude Code is configured.
The VS Code watcher is not running.

Using "push-notifications". Why are Codex VS Code alerts frequent?

Expected outcome:

Codex uses an activity marker, so multiple log events can trigger alerts. Increase debounce time or disable the watcher.

Security Audit

High Risk

v1 • 7/22/2026 Open versioned report

Most of the 285 signals are documentation markers, fixed commands, expected configuration paths, or standard output redirection. Confirmed risks include privileged installation, persistent hooks, shared temporary files, broad process termination, and unencrypted notification delivery. No prompt injection was found, but transport and process controls need correction before broad publication.

Files scanned

929

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

notify.sh:47-74 README.md:94-96

Unencrypted Notification Transport Exposes Topic and Metadata

The curl target omits an HTTPS scheme, so curl defaults to plaintext HTTP. It sends the bearer-like topic, project directory, and optional git statistics.

The executed curl URL is ntfy.sh/${TOPIC} without https://, while the request body contains workspace metadata. The README confirms the topic is the only authentication.

Medium

SKILL.md:189-195

Shell Wrappers Discard Agent Exit Status

The wrapper runs notify.sh after the agent command, so the notification result replaces the agent exit status. Automation can treat failed work as successful.

The wrapper calls command copilot and then notify.sh without saving and restoring the first command status. notify.sh exits with status zero.

Capability review items (32)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

README.md:34

Symlink creation

ln -sf ~/.agents/skills/push-notifications ~/.claude/skills/push-notifications

The installation command force-creates a link inside the Claude skill discovery directory. This intentionally changes which community code Claude can load.

High

SKILL.md:197

PowerShell invocation

**Windows (PowerShell):** Add to `$PROFILE`:

The instruction directs the agent to modify the PowerShell profile with a persistent command wrapper. Future shell sessions will execute the changed profile.

High

SKILL.md:311

PowerShell invocation

- Add the appropriate shell wrapper (platform-aware: `.zshrc` on macOS, `$PROFILE` on Windows PowerS

The instruction can add a wrapper to the PowerShell profile, changing future command behavior. This is a persistent shell configuration change.

High

SKILL.md:312

PowerShell invocation

- Tell the user to `source ~/.zshrc` (macOS/Linux) or `. $PROFILE` (Windows PowerShell) to activate

The instruction sources the modified PowerShell profile, immediately executing profile content. This is security-relevant after an automated profile edit.

High

SKILL.md:101

sudo privilege escalation

| Linux | `sudo apt install qrencode` (Debian/Ubuntu) or `sudo dnf install qrencode` (Fedora) |

The setup instructions explicitly invoke sudo for a system package installation. The package is expected, but the command performs privileged system changes.

High

SKILL.md:161

Hidden file in home directory

Edit `~/.claude/settings.json` — add a Stop hook that calls `notify.sh`:

The setup directs an edit to Claude settings that installs an executable Stop hook. The hook persists and runs after future agent turns.

High

SKILL.md:172

Hidden file in home directory

"command": "~/.agents/skills/push-notifications/notify.sh 'Claude Code'"

The setup directs an edit to Claude settings that installs an executable Stop hook. The hook persists and runs after future agent turns.

High

SKILL.md:187

Hidden file in home directory

**macOS / Linux:** Add to `~/.zshrc` (or `~/.bashrc`):

The setup directs a shell profile edit or wrapper that changes future agent command behavior. This is a persistent executable configuration change.

High

SKILL.md:193

Hidden file in home directory

~/.agents/skills/push-notifications/notify.sh "Copilot"

The setup directs a shell profile edit or wrapper that changes future agent command behavior. This is a persistent executable configuration change.

High

SKILL.md:203

Hidden file in home directory

& "bash" "~/.agents/skills/push-notifications/notify.sh" "Copilot"

The setup directs a shell profile edit or wrapper that changes future agent command behavior. This is a persistent executable configuration change.

High

SKILL.md:207

Hidden file in home directory

**Windows (Git Bash):** Same as macOS/Linux — add to `~/.bashrc`.

The setup directs a shell profile edit or wrapper that changes future agent command behavior. This is a persistent executable configuration change.

High

SKILL.md:252

Hidden file in home directory

# macOS/Linux: add to ~/.zshrc

The setup directs a shell profile edit that starts the watcher on login. This creates explicit persistence across future sessions.

High

SKILL.md:253

Hidden file in home directory

~/.agents/skills/push-notifications/watch-vscode.sh --daemon

The setup directs a shell profile edit that starts the watcher on login. This creates explicit persistence across future sessions.

High

SKILL.md:255

Hidden file in home directory

# Windows: add to PowerShell $PROFILE or Git Bash ~/.bashrc

The setup directs a shell profile edit that starts the watcher on login. This creates explicit persistence across future sessions.

High

SKILL.md:256

Hidden file in home directory

bash ~/.agents/skills/push-notifications/watch-vscode.sh --daemon

The setup directs a shell profile edit that starts the watcher on login. This creates explicit persistence across future sessions.

High

SKILL.md:161

Hidden file access

Edit `~/.claude/settings.json` — add a Stop hook that calls `notify.sh`:

The setup directs an edit to Claude settings that installs an executable Stop hook. The hook persists and runs after future agent turns.

High

SKILL.md:172

Hidden file access

"command": "~/.agents/skills/push-notifications/notify.sh 'Claude Code'"

The setup directs an edit to Claude settings that installs an executable Stop hook. The hook persists and runs after future agent turns.

High

SKILL.md:187

Hidden file access

**macOS / Linux:** Add to `~/.zshrc` (or `~/.bashrc`):

The setup directs a shell profile edit or wrapper that changes future agent command behavior. This is a persistent executable configuration change.

High

SKILL.md:193

Hidden file access

~/.agents/skills/push-notifications/notify.sh "Copilot"

The setup directs a shell profile edit or wrapper that changes future agent command behavior. This is a persistent executable configuration change.

High

SKILL.md:203

Hidden file access

& "bash" "~/.agents/skills/push-notifications/notify.sh" "Copilot"

The setup directs a shell profile edit or wrapper that changes future agent command behavior. This is a persistent executable configuration change.

High

SKILL.md:207

Hidden file access

**Windows (Git Bash):** Same as macOS/Linux — add to `~/.bashrc`.

The setup directs a shell profile edit or wrapper that changes future agent command behavior. This is a persistent executable configuration change.

High

SKILL.md:252

Hidden file access

# macOS/Linux: add to ~/.zshrc

The setup directs a shell profile edit that starts the watcher on login. This creates explicit persistence across future sessions.

High

SKILL.md:253

Hidden file access

~/.agents/skills/push-notifications/watch-vscode.sh --daemon

The setup directs a shell profile edit that starts the watcher on login. This creates explicit persistence across future sessions.

High

SKILL.md:255

Hidden file access

# Windows: add to PowerShell $PROFILE or Git Bash ~/.bashrc

The setup directs a shell profile edit that starts the watcher on login. This creates explicit persistence across future sessions.

High

SKILL.md:256

Hidden file access

bash ~/.agents/skills/push-notifications/watch-vscode.sh --daemon

The setup directs a shell profile edit that starts the watcher on login. This creates explicit persistence across future sessions.

High

watch-vscode.sh:117

Shell command substitution

[[ -f "$last_file" ]] && last_fire=$(cat "$last_file" 2>/dev/null) || true

The script reads attacker-influenceable shared temporary-file content into last_fire and later evaluates it in Bash arithmetic. Predictable shared state can cause injection or denial of service.

High

watch-vscode.sh:115

Temp directory access

local last_file="/tmp/push-notify-debounce-${ext_id}"

The debounce file uses a predictable shared temporary path and is later read and overwritten. Another local user can pre-create or link this path.

Medium

watch-vscode.sh:216

nohup (background persistent process)

nohup bash "$0" start > "$LOG_FILE" 2>&1 &

The daemon option launches the watcher with nohup so it survives the initiating shell. Persistence is intended but remains a real background-process risk.

Medium

watch-vscode.sh:237

Standard device file access

if kill "$PID" 2>/dev/null; then

The stop path signals a PID loaded from a persistent file without verifying the process identity. PID reuse or file tampering can terminate an unrelated process.

Medium

watch-vscode.sh:244

Standard device file access

pkill -f "watch-vscode.sh.*start" 2>/dev/null || true

The broad pkill pattern can terminate unrelated processes whose command lines match watch-vscode.sh and start. Redirecting errors does not limit that scope.

Medium

watch-vscode.sh:245

Standard device file access

pkill -f "tail -F.*exthost.*\.log" 2>/dev/null || true

The broad pkill pattern can terminate unrelated tail processes watching extension logs. The command does not verify that this watcher created those processes.

Medium

watch-vscode.sh:163

Temp directory access

rm -f /tmp/push-notify-debounce-*

The wildcard removal targets every shared temporary file with the prefix, without ownership verification. It can delete state created by other processes or users.

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (50)

🌐 Network access (9)

plugin.json:7 plugin.json:9 plugin.json:10 README.md:31 SKILL.md:18 SKILL.md:106 SKILL.md:115 SKILL.md:125 SKILL.md:248

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/lc700x-push-notifications/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/lc700x-push-notifications/security.svg)](https://skillstore.io/skills/lc700x-push-notifications?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/lc700x-push-notifications?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/lc700x-push-notifications/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/lc700x-push-notifications.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

lc700x. (2026). push-notifications security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/lc700x-push-notifications/audits/1

BibTeX citation

@techreport{lc700x-lc700x-push-notifications-2026,
  author = {lc700x},
  title = {push-notifications security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/lc700x-push-notifications/audits/1},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "push-notifications security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
  - name: "lc700x"
date-released: "2026-07-22"
url: "https://skillstore.io/skills/lc700x-push-notifications/audits/1"
identifiers:
  - type: other
    value: "skillstore:lc700x-push-notifications:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Monitor Long Agent Tasks

Receive a phone alert when a terminal coding agent completes a long task.

Track VS Code Assistants

Run one watcher for Claude Code, Copilot Chat, and Codex extension activity.

Standardize Team Alerts

Configure a self-hosted ntfy endpoint and consistent completion alerts across supported platforms.

Try These Prompts

Set Up Notifications

Set up push notifications for my installed coding agents. Detect my platform, explain each change, and ask before editing configuration.

Add One Agent

Add notifications for [agent]. Preserve existing hooks and shell functions, then send a test alert.

Diagnose Missing Alerts

Check my notification topic, script permissions, configured hooks, and watcher status. Report the cause before making changes.

Harden Self-Hosted Delivery

Configure my ntfy server at [HTTPS URL]. Minimize notification details, secure local files, and review every persistent process.

Best Practices

Use a random topic, restrict its file permissions, and rotate it after accidental disclosure.
Review and approve every hook, shell profile edit, and daemon before activation.
Use HTTPS or a trusted self-hosted ntfy server before sending repository details.

Avoid

Do not commit, publish, or display the full ntfy topic in shared logs.
Do not enable detailed alerts for sensitive repositories without reviewing transmitted metadata.
Do not auto-start watchers or run privileged installation commands without explicit approval.