Notification Hub
v1.0.0Unified notification hub collecting all skill alerts and delivering by priority
⭐ 0· 1.1k·13 current·14 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (centralized notification hub) aligns with the instructions to scan events/, classify priorities, deduplicate, deliver, and save history. However, delivering urgent items via Discord implies access to a Discord bot token or webhook, which is not declared in the skill's requirements.
Instruction Scope
SKILL.md explicitly instructs the agent to read events/ and memory/notifications/ and to read configuration from TOOLS.md; it also directs sending messages (sendDiscordDM) and adding items to heartbeat/daily-report queues. Reading and writing those directories is within the stated purpose, but the instructions assume the agent has permission to access other skills' event files and a configured delivery integration. The skill does not document where channel IDs or credentials live, granting it potentially broad file/system access by implication.
Install Mechanism
Instruction-only skill with no install spec or code files; nothing will be written to disk by an installer. This minimizes install-time risk.
Credentials
The skill requires sending Discord DMs (an external service) but declares no required environment variables or primary credential (no Discord token/webhook). It references TOOLS.md for channel ID but doesn't explain where a bot token or webhook is stored. That missing credential declaration is disproportionate/unexplained. Also, the skill will read events/ and memory/notifications/, which may contain sensitive data from other skills; that access should be explicit and limited.
Persistence & Privilege
always is false and the skill is not automatically persistent. It does instruct saving sent history under memory/notifications/, which is a modest local persistence consistent with its purpose. Nothing in the manifest requests elevated or global privileges.
What to consider before installing
This skill appears to do what it says (aggregate events and send notifications), but before installing: 1) Verify how Discord delivery is configured — where is the bot token or webhook stored? The skill mentions TOOLS.md and a channel ID but does not declare required credentials. 2) Confirm the agent's file permissions: the skill reads events/ and writes memory/notifications/; ensure those directories don't contain sensitive secrets you don't want aggregated or transmitted. 3) Prefer explicit credential handling: require a specific env var (e.g., DISCORD_TOKEN or DISCORD_WEBHOOK) and document where TOOLS.md lives and who can edit it. 4) Test in a sandboxed agent or with a throwaway Discord channel to confirm behavior. 5) If you cannot confirm where channel IDs and tokens are stored, treat the skill as risky and do not enable it for agents with access to sensitive data.Like a lobster shell, security has layers — review code before you run it.
latestvk9736vnm0sm51jvm6c17g1yakn817e37
License
MIT-0
Free to use, modify, and redistribute. No attribution required.