ticketmaster
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
npx @useclawlink/clito manage the Ticketmaster integration. - [EXTERNAL_DOWNLOADS]: The skill downloads and runs the
@useclawlink/clipackage from the public NPM registry. - [CREDENTIALS_UNSAFE]: The skill manages credentials by storing and reading a sensitive key file located at
~/.clawlink/credentials.json. This is standard behavior for the vendor's authentication flow. - [DATA_EXFILTRATION]: The CLI tool communicates with external endpoints at
claw-link.devto authorize and execute Ticketmaster actions. - [PROMPT_INJECTION]: The skill represents an indirect prompt injection surface as it ingests untrusted data from Ticketmaster (event listings, venue data) and processes it using the agent.
- Ingestion points: Data is received via the
runandactionscommands inSKILL.md. - Boundary markers: None explicitly defined in the provided instructions.
- Capability inventory: Subprocess execution via
npxand network operations are present inSKILL.md. - Sanitization: Not explicitly documented in the skill instructions.
Audit Metadata