Notification

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a local history/logging utility rather than a full notification scheduler, with no evident network or credential use, but it stores entered text persistently on disk.

Install only if you are comfortable with a local CLI that keeps notification-related text in `~/.local/share/notification/`. Verify that it actually sends or schedules notifications before relying on it for important reminders.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anything the user or agent passes to the notification command may be retained locally and later searched, viewed, or exported.

Why it was flagged

The script creates a persistent local data directory and stores command input in log files.

Skill content
DATA_DIR="${HOME}/.local/share/notification" ... echo "$ts|$input" >> "$DATA_DIR/run.log"
Recommendation

Avoid putting secrets or sensitive personal data in notifications, and periodically review or delete `~/.local/share/notification/` if needed.

What this means

A user or agent might assume an alert was actually scheduled or delivered when the provided artifacts appear to mainly save a local record.

Why it was flagged

The description advertises notification scheduling/filtering/delivery tracking, while the documented commands are generic and the visible script mainly records inputs to logs.

Skill content
description: "Manage terminal notifications with scheduling, filtering, and delivery tracking." ... `notification run` | Run ... `notification check` | Check ...
Recommendation

Test the command before relying on it for important alerts, and treat it as a local logging utility unless actual notification delivery is verified.

What this means

The skill may not work as documented without additional setup, and users should understand what will be executed if they wire up the CLI manually.

Why it was flagged

The artifacts include `scripts/script.sh` and documentation for a `notification` command, but no install specification explains how that command is created.

Skill content
No install spec — this is an instruction-only skill.
Recommendation

Inspect the included script and confirm the local installation path before invoking or exposing the `notification` command to an agent.