Notify with Pushover

Send push notifications to your phone via Pushover (pushover.net). Use when you want reliable out-of-band alerts from OpenClaw: reminders, monitoring alerts, cron/heartbeat summaries, or 'notify me when X happens' workflows.

This skill's behavior is straightforward: it posts messages to the official Pushover API and prints the response. However, the registry metadata omitted required environment variables (PUSHOVER_APP_TOKEN and PUSHOVER_USER_KEY) and a primary credential declaration — which is likely a metadata oversight but should be fixed. Before installing: (1) confirm you are comfortable providing your Pushover app token and user key to this skill and that you will supply them securely at runtime (do not hardcode into files in a shared repo); (2) review scripts/pushover_send.js yourself (it is short and readable) to verify it only posts to api.pushover.net; (3) prefer scoping the credential to this skill and avoid giving it broader secrets access; and (4) if you need stronger assurance, ask the publisher to update registry metadata to list required env vars and identify the primary credential. If you can't verify the owner or metadata, treat the missing-declaration as a red flag and avoid providing credentials until clarified.

Type: OpenClaw Skill Name: pushover-notify Version: 1.0.0 The OpenClaw skill 'pushover-notify' is benign. Its purpose is to send push notifications via Pushover, which is clearly stated in `SKILL.md`. The `scripts/pushover_send.js` script correctly implements this functionality by making a POST request to the official Pushover API endpoint (https://api.pushover.net/1/messages.json). It securely retrieves credentials from environment variables (`PUSHOVER_APP_TOKEN`, `PUSHOVER_USER_KEY`) as instructed in `SKILL.md`, and does not attempt to exfiltrate data to unauthorized endpoints, execute arbitrary code, or establish persistence. There are no signs of prompt injection attempts in `SKILL.md` or any other malicious behavior.