Universal Notify
v1.0.0Send notifications through multiple channels with a single script. Supports ntfy.sh (free, no signup), Gotify (self-hosted), generic webhooks, email (SMTP/curl), Telegram Bot API, and Pushover. Use when sending alerts, monitoring notifications, deployment notices, or any event that needs to reach a human through their preferred channel. Unified interface with priority levels (low/normal/high/urgent).
⭐ 0· 990·1 current·1 all-time
byJonas Pfalzgraf@josunlp
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the provided implementation: scripts/notify.sh implements ntfy, Gotify, webhook, email, Telegram, and Pushover channels. It requires only curl (documented) and uses CLI arguments for channel credentials, which is consistent with the stated purpose.
Instruction Scope
SKILL.md simply documents usage of scripts/notify.sh and examples match the script. The script performs only network calls to user-supplied URLs and known service endpoints (ntfy.sh, api.telegram.org, api.pushover.net). It does not read other files or environment variables. Note: passing secrets (tokens, SMTP URLs) as CLI args exposes them to process listings and shell history — the docs/examples encourage this pattern, which raises privacy risks even though it's functionally coherent.
Install Mechanism
No install spec — instruction-only plus a single shell script. Nothing is downloaded or installed automatically, so there is minimal install-time risk.
Credentials
The skill declares no required environment variables or credentials and expects credentials as CLI arguments, which is proportionate to its function. However, supplying tokens/keys on the command line can leak them via ps/shell history; consider safer approaches (environment variables, config files with proper permissions) before use.
Persistence & Privilege
always is false and the skill does not request persistent/system-wide configuration or modify other skills. It runs only when invoked and does not enable autonomous background behavior.
Assessment
The script is small and implements exactly the channels described. Before installing or using it: 1) verify the endpoints you provide (especially custom Gotify/webhook URLs) are trusted; 2) avoid passing secrets on the command line (they are visible to other users via process listings and recorded in shell history) — prefer setting them in a protected env or a restricted config file and modifying the script to read them; 3) ensure TLS is used for URLs that carry sensitive payloads; and 4) because the skill source/homepage is unknown, inspect the script locally and consider pinning a vetted copy in your environment rather than pulling from an untrusted registry.Like a lobster shell, security has layers — review code before you run it.
alertsvk973m447xyyck25jyz7a69mbxs80vjx9latestvk973m447xyyck25jyz7a69mbxs80vjx9monitoringvk973m447xyyck25jyz7a69mbxs80vjx9notificationsvk973m447xyyck25jyz7a69mbxs80vjx9ntfyvk973m447xyyck25jyz7a69mbxs80vjx9pushovervk973m447xyyck25jyz7a69mbxs80vjx9telegramvk973m447xyyck25jyz7a69mbxs80vjx9webhookvk973m447xyyck25jyz7a69mbxs80vjx9
License
MIT-0
Free to use, modify, and redistribute. No attribution required.