onesignal-custom-events — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited onesignal-custom-events (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Help the agent design, send, and use OneSignal Custom Events — named records of user behavior that drive automation, personalize messages, and feed segmentation.
This is a reasoning guide, not a script.
Trigger phrases: "track [user action]", "send a custom event", "design an event taxonomy", "trigger a Journey on [event]", "use event properties in a template", "import events from [Segment / Amplitude / Mixpanel / Snowflake / BigQuery / Kafka]", "import from Google Sheets", "tag vs custom event", "why isn't my event firing", "verify my events are reaching OneSignal", "what's the event payload limit".
Lookalike intents that should NOT trigger this skill:
onesignal-journeys.onesignal-segments.A Custom Event is a record of something that happened at a specific point in time. Unlike Tags, events do NOT permanently update a user's profile — they record behavior.
When to use Custom Events:
When to use Tags instead:
A Custom Event has these fields:
name (required, string, max 128 chars).properties (optional object) — pairs that describe the event (item, price, plan, etc.). Used for personalization and Journey property filters.external_id OR onesignal_id — identifies the user. Required when sending via the Create Custom Events API.timestamp (optional, ISO 8601) — when the event occurred (defaults to ingest time).idempotency_key (optional UUID) — prevents duplicate processing on retry.Hard limits:
Sources: SDK (mobile + web), Create Custom Events API, integrations (Segment, Amplitude, Mixpanel, Snowflake, BigQuery, Kafka, Google Sheets, and 25+ others). All sources are billed equivalently.
For the full ingestion API, integration list, retention behavior, and Journey property storage rules (the "100 properties per Journey instance" rule), read REFERENCE.md.
Each dimension has a priority tag:
signup_completed, purchase_completed, cart_updated, payment_failed). Stable and meaningful. Don't rename events that live Journeys depend on.external_id is the standard. Confirm the user has been logged into the SDK first or that backend events include external_id.idempotency_key recommended for retried backend events. Required when the same event might fire twice (SDK + backend webhook duplicates).timestamp only for backfill or out-of-order events.list_custom_events to see what events already exist. Don't propose a new event if a similar one is already flowing.list_journeys to see if it's already wired in.purchase_completed event AND lifetime_value tag both make sense.)cart_updated (with cart contents in properties) AND a purchase_completed exit. Surface the "same event for entry + exit = restart timer with fresh data" pattern.idempotency_key. Diagnose source breakdown.timestamp field. Surface that segmentation time-filters reference event RECEIVED time, not original event time — for historical imports where original time matters, store it as a Tag.Apply silently and surface as assumptions:
purchase_completed, not Purchase or purchaseEvent.)idempotency_key (UUID) for any event sent from a server with retries.Best practices:
purchase_completed event with {order_id, total, currency, item_count} + a lifetime_value Tag updated on the same hook.signup_completed, profile_completed, first_action_completed) — easier to branch on than a single onboarding_state event.cart_updated with full cart contents in properties; purchase_completed as the exit signal.timestamp to preserve original event time. Use idempotency_key derived from (user, event, timestamp) to prevent reimport duplicates.For full integration setup paths (Segment, Amplitude, Mixpanel, Snowflake, BigQuery, Kafka, Google Sheets), Liquid syntax for event properties, segmentation Early Access limits, and SDK code samples per platform, read REFERENCE.md. For full reasoning traces, read EXAMPLES.md.
Every summary must include:
external_id from SDK login, or backend value).idempotency_key-based dedup; that's the #1 cause of duplicate Journey messages.Require explicit user approval before sending events to a production app.
Avoid:
purchaseEvent, Purchase, purchases). Stick to snake_case past-tense.REFERENCE.md — Create Custom Events API shape, integration list with setup paths, Liquid syntax for event properties, Journey property storage rules (100-per-instance limit), Custom Event segmentation Early Access details, Tags vs Custom Events comparison.EXAMPLES.md — worked traces (purchase event design, abandoned cart, signup flow, debugging duplicates, SDK vs backend, "is this an event or a tag", historical backfill).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.