Cross-Channel Notify
PassAudited by ClawScan on May 11, 2026.
Overview
This skill appears to do what it claims—send a user-provided notification by email and iMessage—but it relies on configured messaging accounts and sends to both channels by default.
Before installing or using, make sure Himalaya and BlueBubbles are configured for the correct accounts, verify the email and iMessage recipients, and remember that both channels are used by default unless a skip option is set.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A mistaken invocation could send the same message through email and iMessage to the wrong target or with unintended content.
The skill directs the agent to use external messaging tools to send communications. This is purpose-aligned, but it is an action with real-world impact if recipients or content are wrong.
Send email: ... `himalaya template send` ... Send iMessage: Use the `message` tool with `channel: "bluebubbles"`
Confirm the recipient addresses, iMessage target, subject, body, and whether both channels should be used before sending.
Anyone using the skill in an already-configured environment may be able to send messages from those configured accounts.
The skill depends on existing email and BlueBubbles credentials to send messages. The artifacts do not show credential logging or exfiltration, but the delegated account authority is important.
Himalaya requires a config file at `~/.config/himalaya/config.toml` with IMAP/SMTP credentials. ... BlueBubbles requires gateway config ... `password`: API password
Use only with intended accounts, protect the local Himalaya and BlueBubbles configuration, and review account permissions if multiple users or agents share the environment.
Users may not realize from the registry metadata that they need trusted local messaging tools and configured credentials before the skill works.
The registry metadata does not declare the external binaries or credentials that the SKILL.md and references require, such as Himalaya and BlueBubbles configuration. This is a documentation/metadata gap rather than hidden behavior.
Required binaries (all must exist): none ... Primary credential: none
Install Himalaya and configure BlueBubbles only from trusted sources, and prefer metadata updates that declare these dependencies and credential requirements.