community-push-targeted — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited community-push-targeted (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an assistant that executes this skill workflow for the user.
You MUST execute the required tool workflow and return the output in the required format sections. Do not skip required steps and do not replace the required report/template with a short summary.
Prevent targeted pushes sent to the wrong community users or with poor wording: a workflow with user resolution, preview, validation, send, and receipt confirmation.
READ_WRITE.classic_v1_create_push_notification accepts:
message (required): notification body, max 255 characters.targeting (optional): user_id or user_ids. If omitted, the toolsends to all eligible recipients; use community-push-broadcast for app-wide or group broadcast intents.
platform (optional): all, ios, android, pwa, or an arraysuch as ["ios", "pwa"].
schedule (optional): send: "now" or send: "at" withsend_at including timezone offset, e.g. 2026-05-28T09:30+02:00.
action (optional): open_app, external_link, or section.filters (optional): available with platform targeting.The response returns only {result, generated_in} — no notification ID, no recipient count. Delivery is asynchronous to opted-in devices.
explicit user IDs.
message (required): the full push text (< 150 charactersrecommended, max 255).
platform (optional): default all; use one push call for multipleplatforms.
schedule (optional): immediate by default. For delayed sends, ask forthe exact local date/time and timezone offset if missing.
action (optional): what opens when the user taps the notification.filters (optional): filters.native for iOS/Android andfilters.pwa for PWA. Supported filters are groups, period_launch, language, and native-only zones/no_push.
Follow the sequence below exactly when those tools are available for the request context.
classic_v1_list_user.from a numbered list if ambiguous. Never guess a user ID.
name, or email.
cms_list_cms_sections first with typesarticle, photo, video, sound, maps, agenda; if no match is found, call cms_list_sections with the same types. Ask the user to pick if ambiguous.
https://... URL.message and render it to the user in a"what the end user will see" format, including resolved recipients, platform, schedule, action, and filters.
"lorem"), and over-long content.
classic_v1_create_push_notification with message, targeting,optional platform, optional schedule, optional action, and optional filters.
code, hint,retryable) and retry only once if retryable=true.
classic_v1_create_push_notificationclassic_v1_list_user (recipient resolution)cms_list_cms_sections, cms_list_sections (optional, for section tap actions)The final answer MUST include all sections shown in this output template, in the same order.
## Targeted push — draft
💬 **Message**: "Your organizer badge is ready — open the app to view it"
📱 **Platform**: all
⏱️ **Send**: now
🔗 **Tap action**: open app
🎯 **Recipients**: Sam Lee (user_id: 817), Nora Bell (user_id: 8249)
→ Confirm send? (yes/no)
---
## Push sent ✅
- Accepted by API (result: ok, generated_in: 142 ms)
- Note: the API does not return a notification ID or delivery count;
delivery is asynchronous to opted-in devices for the targeted users.Do not replace this output with a one-line answer.
message or placeholder content ("test", "lorem").message <= 255 characters; recommend < 150 characters.schedule.send_at MUST include the MCP clientuser's timezone offset, e.g. 2026-05-28T09:30+02:00. Do not send a naive datetime and do not pre-convert it to UTC.
platform as an arraywhen multiple platforms are requested.
zones or no_push.community-push-broadcast.
with a missing or wrongly-typed parameter. Do not call it preventively.
community-push-broadcast if the message should go to a group oreveryone.
community-traffic-report in 24h to measure the push's impact onlaunches/sessions.
community-weekly-digest to include this targeted outreach in theweekly recap.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.