Notification Hub
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: mupeng-notification-hub Version: 1.0.0 The skill bundle defines a 'notification-hub' that collects event files from `events/`, classifies them by priority, prevents duplicates using history stored in `memory/notifications/`, and delivers them via Discord DMs or internal queues. While it involves local file system access (read/write) and external network communication (Discord DMs), these capabilities are directly aligned with the stated purpose of a notification hub. There is no evidence of data exfiltration beyond notification content, malicious execution, persistence mechanisms, or prompt injection attempts against the agent to perform unauthorized actions. The JavaScript snippets are illustrative of the intended logic, and the usage examples guide the agent to manage notifications as expected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Urgent alerts may be sent quickly without a separate confirmation step once the notification flow is in use.
The skill instructs immediate external delivery for urgent notifications based on event priority. This is consistent with the notification-hub purpose, but users should ensure priority rules and destinations are correct.
urgent — Immediate Discord DM ... Send immediately (within 1 min)
Verify what counts as urgent and confirm the Discord destination before relying on automatic alert delivery.
Local notification metadata may persist across sessions and show which alerts were sent, when, and through which channel.
The skill stores notification history in local memory files for duplicate prevention. The example mainly stores metadata, but notification histories can still reveal activity patterns or alert sources.
History Storage memory/notifications/ ├── sent-2026-02-14.json
Review retention expectations for memory/notifications/ and avoid storing sensitive message bodies unless needed.
Alerts from multiple skills, potentially including account activity or message-related events, may be summarized together or routed to Discord, heartbeat, or daily-report flows.
The skill is designed to aggregate file-based events from multiple skills. This is central to its purpose, but it means outputs from other skills may be combined and forwarded through notification channels.
Collect all event files from `events/` directory ... health-monitor ... data-scraper ... insta-post ... competitor-watch ... skill-composer
Use this with trusted event-producing skills and keep sensitive event contents minimal or redacted before notification delivery.