onesignal-journeys — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited onesignal-journeys (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Help the agent design and reason about OneSignal Journeys — multi-step automated messaging flows that deliver push, email, SMS, in-app messages, and web push based on user behavior, time delays, segment membership, or custom events.
This is a reasoning guide, not a script. Synthesize the actual questions, options, and Journey shape based on what the user said.
Trigger phrases: "create a journey", "build an automation", "set up a welcome series / onboarding flow", "create a re-engagement / win-back flow", "build an abandoned cart flow", "send a drip campaign", "send a recurring weekly message", "trigger a flow when [event]", "branch users on [behavior]", "send a follow-up if the user doesn't [action]", "improve this Journey", "why is my Journey not entering users".
Lookalike intents that should NOT trigger this skill:
messages skill.templates skill.custom-events skill.A Journey is composed of:
Entry rules are either Segment-based OR Custom Event-based — never both. The choice fundamentally shapes the Journey:
For the full product rules (entry/exit/re-entry behavior, lock-when-live constraints, IAM session rules, plan limits, etc.) read REFERENCE.md.
Each dimension below has a priority tag — use it to decide what to ask vs assume:
Skip the wizard whenever possible. Before any AskUserQuestion call:
list_journeys to detect duplicates of the user's intent (don't recreate "Welcome Series" if it already exists; offer to inspect/duplicate/improve instead).list_segments to see what exists. Don't invent a Segment definition the user could pick.list_custom_events to confirm the event name actually exists. Flag missing events as a prerequisite.cart_updated and purchase_completed event are usually required — confirm both before designing.Before composing any AskUserQuestion call, run this decision table. Anything that resolves here is a silent default: declare it as an assumption in the final summary, don't ask about it.
| Dimension | Skip If | Silent Default |
|---|---|---|
| Channels | Pattern is onboarding / re-engagement / abandoned cart / recurring | Onboarding: push + email. Re-engagement: push then email. Abandoned cart: push then email then SMS. Recurring: pattern-named channel. |
| Cadence / step timing | Pattern is named (onboarding / re-engagement / abandoned cart) | Onboarding: D0 / D2 / D7 / D14. Re-engagement: threshold ÷ 3, ÷ 1.5, ÷ 1. Abandoned cart: 1h, 24h. |
| Re-entry | Always defaultable from pattern | Onboarding: none. Re-engagement: matches inactivity threshold. Abandoned cart: always (Custom Event entry). Recurring: matches cadence, strictly > time-window duration. |
| Schedule | Always defaultable | Start now, no end date. |
| Exit rules | Pattern is named | Onboarding: goal action (ask if not stated). Re-engagement: "user becomes active". Abandoned cart: purchase_completed + cart_updated (re-restart). |
| Entry rule type | Pattern dictates it | Onboarding / abandoned cart → Custom Event. Re-engagement → Segment. Recurring → Segment with Time Window. |
| Name / description | Always defaultable | Suggest a clear name from pattern + audience; surface in summary, let user override. |
| Branching shape | No branching mentioned and pattern doesn't require it | Linear; add Yes/No only when summary explicitly needs it (e.g., onboarding goal check). |
Only ask about dimensions that none of the above pin down AND the user didn't specify. If everything pins down, skip AskUserQuestion entirely and summarize with assumptions named.
list_custom_events, list_segments, etc.).Apply to every question before including it in a batch:
list_custom_events, specific duration, recommended default). Never use generic placeholders like "Standard" or "Custom" without saying what they map to.header field should explain why this matters, not restate the question. ("This becomes the exit condition" beats "Goal action".)"Push + Email — recommended for onboarding". Don't make the user guess."Type your answer…" (or domain-flavored equivalent like "Describe a different cadence…").If a candidate question fails any of these, fix it or drop it.
cart_updated AND same event as exit (so cart updates restart the timer); confirm event names exist.journey_count tag pattern with audience exclusion at the cap.Apply per-pattern defaults silently and surface them as assumptions in the summary:
signup_completed (fall back to "Subscribed Users" segment + Future additions only if no event), no re-entry, push + email, day-0 / day-2 / day-7 cadence.last_session > N days with mirrored Excluded Segment, exit on "user becomes active", re-entry after N days, push then email.cart_updated with same event as exit, plus purchase_completed exit, push at 1h then email at 24h.Other defaults: After any Tag User step, add a ~15-minute Wait before any webhook/personalized step that depends on the tag. Mix channels — don't stack two pushes back-to-back. Always suggest a clear Journey name.
For full per-pattern recipes and edge cases, read EXAMPLES.md.
Every summary must include:
Require explicit user approval before creating, launching, archiving, or deleting. For edits to a live Journey, call out which changes apply immediately to in-flight users and which apply only to future entrants.
Avoid:
idempotency_key.REFERENCE.md — full product rules: entry/exit/re-entry semantics, edit-live behavior, Custom Event mechanics, webhook constraints, IAM rules, plan limits. Read when verifying a constraint or warning the user about a lock.EXAMPLES.md — worked reasoning traces (minimal prompt, fully-specified prompt, ambiguous term, channel-not-set-up, user-pushes-back, skip-AskUserQuestion-entirely). Read when the user's request resembles a known pattern.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.