Web Push Notifications

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 1.0.0

Overview

This is a coherent Web Push reference skill, but users should handle push credentials and subscription data carefully.

Install with normal npm supply-chain care, preferably as a pinned local project dependency rather than a global unpinned CLI. Treat VAPID private keys, GCM keys, and push subscription endpoint/key material as sensitive, avoid pasting real secrets into command-line arguments, and disclose and protect backend storage of user push subscriptions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/webpush.md:6
• Finding: Unpinned Third-Party npm Dependency Installation<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:104` - `references/webpush.md:6` - `references/webpush.md:130` **Vulnerability Type**: Unpinned and globally installed third-party dependency **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:104` and `references/webpush.md:130`: ```bash npm install web-push -g ``` `references/webpush.md:6`: ```bash npm install web-push --save ``` ### Technical Analysis The installation instructions identify `web-push` only by package name and do not pin a reviewed version or enforce a lockfile and integrity metadata. Consequently, the package version retrieved when a user follows the instructions can change after this Skill has been reviewed. npm packages can run lifecycle scripts during installation and execute application code when imported. If a future package release, transitive dependency, maintainer account, or registry resolution path is compromised, following these instructions could execute unreviewed code with the privileges of the installing user. The global installation form further expands exposure by placing an executable in the user's global npm environment. No evidence establishes that the named package is currently malicious; the risk arises from mutable dependency resolution and insufficient supply-chain controls. ### Attack Path 1. An attacker compromises the package publisher, a transitive dependency, or another relevant part of the package distribution chain. 2. The attacker publishes a malicious version containing an installation lifecycle script or modified runtime/CLI behavior. 3. A user follows the documented unversioned `npm install web-push` instruction. 4. npm resolves and downloads the malicious release because no reviewed version or lockfile is enforced. 5. Malicious lifecycle code executes during installation, or malicious behavior executes when the package or global CLI is subsequently used. ### Impact Assessment Successful exploitation could execute arbit ...[truncated 383 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `web-push` to a specifically reviewed version rather than resolving an unrestricted current release. - Install the package locally instead of globally wherever possible. - Generate and commit a package lockfile, then require reproducible installation through `npm ci`. - Review lockfile changes and dependency provenance before upgrades. - Use npm registry integrity metadata and automated dependency vulnerability scanning. - Consider disabling lifecycle scripts during initial inspection with `npm ci --ignore-scripts`, where compatible, and explicitly review any scripts before allowing them. - Replace the global CLI example with a locally pinned invocation, such as an npm script or `npx --no-install`, so it cannot silently fetch a different package version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:108
• Finding: Sensitive Push Credentials Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:108-116` - `references/webpush.md:135-145` **Vulnerability Type**: Sensitive credentials exposed through process arguments and command history **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:108-116`: ```bash web-push send-notification \ --endpoint=https://fcm.googleapis.com/fcm/send/... \ --key=<p256dh> --auth=<auth_secret> \ --vapid-subject=mailto:[e-mail] \ --vapid-pubkey=<pub> --vapid-pvtkey=<priv> \ --payload="Hello" [--ttl=<seconds>] [--encoding=aesgcm|aes128gcm] ``` `references/webpush.md:135-145`: ```bash web-push send-notification \ --endpoint=https://fcm.googleapis.com/fcm/send/... \ --key=<p256dh> \ --auth=<auth_secret> \ --payload="Message content" \ --vapid-subject=mailto:[e-mail] \ --vapid-pubkey=<VAPID public key> \ --vapid-pvtkey=<VAPID private key> \ --ttl=3600 \ --encoding=aes128gcm \ --gcm-api-key=<GCM key> ``` ### Technical Analysis The examples direct users to substitute sensitive values directly into command-line arguments. These values include: - The VAPID private key used to authenticate the application server. - The legacy GCM API key. - The subscription authentication secret. - Subscription key material and endpoint information. Command-line arguments may be retained in shell history, terminal recordings, CI/CD logs, diagnostic output, audit systems, or process-monitoring interfaces. On systems where process arguments are visible to other users or monitoring agents, credentials can be collected while the command is running. Copying the command into scripts or support tickets can create additional persistent copies. Payload encryption is necessary for Web Push and the outbound request itself is consistent with the declared functionality. However, exposing credentials through `argv` is not necessary to perform that function and exceeds the minimum safe disclosure surface. ### Attack Path 1. A user replaces ...[truncated 1416 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not place private keys, API keys, or subscription authentication secrets directly in command-line arguments. - Prefer a protected configuration file with restrictive filesystem permissions, a secrets manager, or a wrapper that reads secrets from standard input. - Where environment variables are unavoidable, inject them through a protected runtime secret facility and ensure they are not printed by debugging or CI tracing. - Store VAPID private keys in a managed secret store and apply least-privilege access controls and audit logging. - Redact endpoint data, private keys, authentication secrets, and API keys from application, terminal, and CI logs. - Disable shell command tracing around sensitive operations and avoid saving sensitive commands in shell history. - Rotate VAPID or GCM credentials after suspected exposure and invalidate or replace affected subscriptions where appropriate. - Update the examples to use placeholder configuration references rather than arguments that encourage users to paste secrets into `argv`. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Hidden Instructions

High

• Category: Prompt Injection

Content

# web-push Complete API Reference

## Installation & Configuration

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# web-push Complete API Reference

## Installation & Configuration

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The client-side example instructs sending `subscription.toJSON()` to `/api/subscribe`, which includes endpoint and key material associated with the user's push subscription. In this markdown file, there is no accompanying warning that subscription details are being transmitted to a backend or that they should be handled as user-associated data.

Static analysis

No suspicious patterns detected.