intercom-enterprise-rbac
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill manages Intercom API tokens and client secrets through environment variables (
process.env.INTERCOM_ACCESS_TOKEN), which is a best practice to avoid hardcoding sensitive credentials in source code. - [EXTERNAL_DOWNLOADS]: The skill references the official
intercom-clientpackage and communicates with legitimate Intercom API endpoints (api.intercom.io,app.intercom.com). These are recognized well-known service domains. - [INDIRECT_PROMPT_INJECTION]: The skill contains logic to fetch administrative and team data from the Intercom API. This represents a potential surface for indirect injection if an attacker-controlled workspace contains malicious names or metadata. However, the risk is addressed by the skill's intended use for administrative inventory and the lack of complex decision-making based on that data.
- [SAFE]: The OAuth implementation includes necessary security primitives, such as the use of a cryptographically secure
stateparameter to prevent Cross-Site Request Forgery (CSRF) and the definition of least-privilege scopes for access control.
Audit Metadata