intercom-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted data from external Intercom conversations, which presents a surface for indirect prompt injection where malicious instructions could be embedded in user messages to influence agent actions.
- Ingestion points: Conversation data and thread parts are ingested from the Intercom API in references/implementation.md using client.conversations.find() and client.conversations.search().
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between its system instructions and the retrieved conversation content, which might be treated as authoritative.
- Capability inventory: The skill provides capabilities to write to the API, including replying to messages, assigning conversations, and changing conversation states (close/assign/snooze), which could be leveraged by injected content.
- Sanitization: No sanitization, filtering, or validation of conversation bodies is demonstrated in the implementation examples before the content is processed by the agent.
Audit Metadata