intercom
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
@useclawlink/clivianpx, which involves downloading and executing code from the NPM registry. This package belongs to the skill vendor's official infrastructure. - [COMMAND_EXECUTION]: The skill involves executing shell commands to log in, connect to Intercom, and perform actions like creating contacts or conversations. These are controlled via a specific CLI tool.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from Intercom (such as support conversations and articles), which represents a surface for indirect prompt injection if external users include malicious instructions in their messages.
- Ingestion points: Intercom conversation data and article content.
- Boundary markers: None explicitly defined in the instruction text.
- Capability inventory: The skill can create, read, and update data in Intercom via CLI commands.
- Sanitization: Relies on the underlying agent's standard handling of tool outputs.
Audit Metadata