ticketmaster

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using npx @useclawlink/cli to manage the Ticketmaster integration.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and runs the @useclawlink/cli package from the public NPM registry.
  • [CREDENTIALS_UNSAFE]: The skill manages credentials by storing and reading a sensitive key file located at ~/.clawlink/credentials.json. This is standard behavior for the vendor's authentication flow.
  • [DATA_EXFILTRATION]: The CLI tool communicates with external endpoints at claw-link.dev to authorize and execute Ticketmaster actions.
  • [PROMPT_INJECTION]: The skill represents an indirect prompt injection surface as it ingests untrusted data from Ticketmaster (event listings, venue data) and processes it using the agent.
  • Ingestion points: Data is received via the run and actions commands in SKILL.md.
  • Boundary markers: None explicitly defined in the provided instructions.
  • Capability inventory: Subprocess execution via npx and network operations are present in SKILL.md.
  • Sanitization: Not explicitly documented in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 02:43 PM
Security Audit — agent-trust-hub — ticketmaster