freshdesk-automation
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires connection to a remote MCP provider for operation.
- The setup instructions direct users to register an external endpoint at https://rube.app/mcp as an MCP server.
- The skill references toolkit documentation hosted at https://composio.dev/toolkits/freshdesk.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data and has write capabilities, which creates a surface for indirect injection attacks.
- Ingestion points: The agent retrieves and reads ticket subjects, descriptions, and conversation history via tools such as FRESHDESK_VIEW_TICKET, FRESHDESK_GET_SEARCH, and FRESHDESK_LIST_ALL_TICKET_CONVERSATIONS (SKILL.md).
- Boundary markers: There are no specific delimiters or instructional boundaries defined in the skill to isolate untrusted ticket content from the agent's core instructions (SKILL.md).
- Capability inventory: The skill can perform network writes, including sending replies (FRESHDESK_REPLY_TO_TICKET), adding internal notes, and updating ticket status across the helpdesk (SKILL.md).
- Sanitization: No evidence of input validation or sanitization for the HTML and plain text content fetched from Freshdesk is provided (SKILL.md).
Audit Metadata