shop-push-broadcast — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited shop-push-broadcast (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an assistant that executes this skill workflow for the user.
You MUST execute the required tool workflow and return the output in the required format sections. Do not skip required steps and do not replace the required report/template with a short summary.
Prevent pushes sent by mistake or poorly written: a workflow with preview, review, validation, send, and receipt confirmation. This skill is for shop-wide broadcasts to all eligible push recipients.
READ_WRITE.shop_create_push_broadcast accepts:
message (required): notification body, max 255 characters.schedule (optional): send: "now" or send: "at" withsend_at including timezone offset, e.g. 2026-05-28T09:30+02:00.
action (optional): tap action. Default is open_app.Supported action types include open_app, external_link, section, and product_url.
The response returns only {result, generated_in} — no broadcast ID, no recipient count. Delivery is asynchronous to opted-in devices.
For targeted shop pushes to specific customers or prospects, use shop-push-targeted instead.
message (required): the push text the user will read. Keep itconcise (< 150 characters recommended) since the full string is the notification body on device.
schedule (optional): immediate by default. For delayed sends, ask forthe exact local date/time and timezone offset if missing.
action (optional): what opens when the user taps the notification.shop_list_customers first to show the user an approximate registered base before sending.
Follow the sequence below exactly when those tools are available for the request context.
shop_list_products when the product is named;fuzzy-match by title/slug and use product_slug. Never use section_id/item_id for products.
cms_list_cms_sections first with typesarticle, photo, video, sound, maps, agenda; if no match is found, call cms_list_sections with those types plus commerce. Ask the user to pick if ambiguous.
https://... URL.message and render it to the user in a"what the end user will see" format.
"lorem"), and over-long content.
shop_list_customers to showapproximate reach. This is an estimate of the registered customer base, not the opted-in push audience — flag this to the user.
shop_create_push_broadcast with message, optional schedule, andoptional action.
code, hint,retryable) and retry only once if retryable=true.
shop_create_push_broadcastshop_list_customers (optional, for audience estimate)shop_list_products (optional, for product tap actions)cms_list_cms_sections, cms_list_sections (optional, for section tap actions)The final answer MUST include all sections shown in this output template, in the same order.
## Push broadcast — draft
💬 **Message**: "Sale -20% this weekend — until Sunday 11:59 PM on the Summer collection"
⏱️ **Send**: now
🔗 **Tap action**: product "Summer tote" (slug: summer-tote)
🎯 **Target**: all opted-in shop app users (registered base est.: 8,320)
→ Confirm send? (yes/no)
---
## Push sent ✅
- Accepted by API (result: ok, generated_in: 142 ms)
- Note: the API does not return a broadcast ID or a delivery count;
delivery is asynchronous to opted-in devices (a subset of the
registered base).Do not replace this output with a one-line answer.
message or placeholder content ("test", "lorem").message <= 255 characters; recommend < 150 characters.(e.g. 10,000), require a reinforced confirmation.
schedule.send_at MUST include the MCP clientuser's timezone offset, e.g. 2026-05-28T09:30+02:00. Do not send a naive datetime and do not pre-convert it to UTC.
say it is not available for shop push notifications.
product_url, resolve the product and pass product_slug.section://; provide section_id and let the tool resolve the public URL, or provide a known https://... URL/path.
shop-traffic-report in 24h to measure the push's impact onlaunches/sessions.
shop-best-sellers if the push targeted a specific product orcollection.
shop-promo-campaign if the send implies a discount that's notyet created.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.