intercom
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the official Intercom API domain (api.intercom.io), which is a well-known service. No suspicious network operations to untrusted domains were detected.
- [SAFE]: User-provided API tokens are stored locally in the home directory (~/.config/intercom/token) with restricted file permissions (0600), adhering to security best practices for secret management.
- [SAFE]: The skill implementation uses only Ruby standard libraries (json, net/http, uri, fileutils), avoiding supply chain risks associated with third-party gems or remote script execution.
- [SAFE]: Although the skill processes external data (Intercom conversation and article content), it does not possess exploitable capabilities such as arbitrary shell execution or file writes that could be targeted by indirect prompt injection. Basic sanitization (HTML tag removal) is also performed on the content before display.
Audit Metadata