pushplus

Send push notifications via pushplus HTTP API to WeChat, email, webhook, SMS and more. Use when the user asks to send notifications, push messages, WeChat me...

This skill appears coherent and low-risk: it only needs a PushPlus API token and uses curl to call the official PushPlus endpoints. Before installing or using it, consider: (1) Provide the token via environment variable rather than pasting it into chat to avoid leaking it in conversation history. (2) Confirm the agent follows the SKILL.md safety rules — especially that it asks you for confirmation before sending any message and does not store or print the full token. Because the skill is instruction-only, there is no code enforcing those rules; they depend on the agent implementation. (3) Avoid including sensitive secrets or PII in messages sent through a third-party service; if you must, review PushPlus’s privacy/security policy. (4) If the token is ever exposed, revoke/regenerate it immediately. If you want stronger guarantees, prefer a skill with audited code or one that performs token handling within vetted code rather than free-form agent instructions.

Type: OpenClaw Skill Name: pushplus-notification Version: 1.0.1 The pushplus-notification skill is a legitimate tool for sending notifications via the PushPlus HTTP API. The instructions in SKILL.md include proactive security measures, such as explicitly directing the AI agent to only extract the PUSHPLUS_TOKEN from .env files while ignoring other secrets, requiring user confirmation before execution, and masking tokens in logs. No malicious execution patterns or unauthorized data exfiltration behaviors were identified.