intercom-core-workflow-a

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides legitimate instructions and code examples for interacting with the Intercom REST API via the official intercom-client SDK.
  • [CREDENTIALS_UNSAFE]: The skill follows security best practices by referencing process.env.INTERCOM_ACCESS_TOKEN for authentication rather than hardcoding secrets or providing unsafe instructions for credential storage.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the standard intercom-client package, which is the official and trusted SDK for Intercom integrations.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it retrieves contact and segment data from the Intercom API.
  • Ingestion points: references/implementation.md and references/examples.md (Contact search, list, and segment results).
  • Boundary markers: Absent in code snippets, though typical for SDK usage.
  • Capability inventory: The skill utilizes intercom-client for REST API operations (create, update, search, merge, list).
  • Sanitization: Not explicitly handled in the provided logic templates, but the usage is restricted to standard API interactions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:44 AM