Notification Hub

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Urgent alerts may be sent quickly without a separate confirmation step once the notification flow is in use.

Why it was flagged

The skill instructs immediate external delivery for urgent notifications based on event priority. This is consistent with the notification-hub purpose, but users should ensure priority rules and destinations are correct.

Skill content
urgent — Immediate Discord DM ... Send immediately (within 1 min)
Recommendation

Verify what counts as urgent and confirm the Discord destination before relying on automatic alert delivery.

What this means

Local notification metadata may persist across sessions and show which alerts were sent, when, and through which channel.

Why it was flagged

The skill stores notification history in local memory files for duplicate prevention. The example mainly stores metadata, but notification histories can still reveal activity patterns or alert sources.

Skill content
History Storage

memory/notifications/
  ├── sent-2026-02-14.json
Recommendation

Review retention expectations for memory/notifications/ and avoid storing sensitive message bodies unless needed.

What this means

Alerts from multiple skills, potentially including account activity or message-related events, may be summarized together or routed to Discord, heartbeat, or daily-report flows.

Why it was flagged

The skill is designed to aggregate file-based events from multiple skills. This is central to its purpose, but it means outputs from other skills may be combined and forwarded through notification channels.

Skill content
Collect all event files from `events/` directory ... health-monitor ... data-scraper ... insta-post ... competitor-watch ... skill-composer
Recommendation

Use this with trusted event-producing skills and keep sensitive event contents minimal or redacted before notification delivery.