onesignal-mobile-sdk-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited onesignal-mobile-sdk-setup (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Help the agent guide users through OneSignal mobile SDK integration, initialization, and troubleshooting for push notifications, in-app messages, and Live Activities.
This is a reasoning guide, not a script.
Trigger phrases: "set up the mobile SDK", "install OneSignal in my [platform] app", "configure APNs / FCM / HMS", "where's my App ID", "push isn't delivering", "rich push isn't working", "in-app messages aren't showing on iOS", "do I need the SDK", "what works without the SDK", "set up Live Activities", "switch from [other ESP] to OneSignal".
Lookalike intents that should NOT trigger this skill:
messages skill.Mobile push setup is two parts — both required for delivery:
The two parts are independent. SDK code can compile and the app can ship while push silently fails because credentials are missing — and vice versa. Always reason about which side a problem lives on before suggesting fixes.
The OneSignal App ID is a 36-char UUID found in Dashboard → Settings → Keys & IDs. A single OneSignal app can support multiple platforms — no need to duplicate apps per platform.
For per-platform install steps, init APIs, Notification Service Extension setup, App Group configuration, ADM/HMS specifics, and the diagnostic order for troubleshooting, read REFERENCE.md.
Each dimension has a priority tag:
get_platform_settings to see what credentials are already configured. Skip the "do you have credentials set up?" question if you can see they do.REFERENCE.md — credentials → SDK init → subscription with token → permission granted → test target type.Apply silently and surface as assumptions:
OneSignal.login(externalId) so user records unify across devices.For full per-platform install steps, init APIs, NSE/App Group setup, Live Activities, and diagnostic recipes, read REFERENCE.md. For full reasoning traces, read EXAMPLES.md.
This skill is primarily instructional and diagnostic — most setup guidance doesn't need approval.
Require explicit user approval before any write action:
Before any write action, summarize what will change, where, why, and what to test afterward.
Never ask the user for secrets, API keys, p8 keys, p12 certificates, or private credentials in chat. Direct them to upload via the dashboard.
Avoid:
REFERENCE.md — per-platform install + init APIs, Notification Service Extension setup, App Group config for confirmed delivery + badges, Huawei/Amazon specifics, Live Activities, the canonical diagnostic order for "push isn't delivering".EXAMPLES.md — worked traces (vague request, iOS first-time setup, Android FCM debugging, RN bare vs Expo, Live Activities, in-app messages not showing, "push works on Android but not iOS").~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.