intercom-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
intercom-clientnpm package. This is the official SDK provided by Intercom, a well-known service, and is a standard dependency for this integration integration workflow. - [INDIRECT_PROMPT_INJECTION]: The skill processes data retrieved from the Intercom API, such as contact details and conversation content, which represents a potential surface for instructions embedded in external data.
- Ingestion points: Data is ingested through API calls in
references/walkthrough.md(e.g.,client.contacts.search) andreferences/complete-script.md(e.g.,client.contacts.list). - Boundary markers: The instructions do not define specific delimiters for separating API-provided data from agent instructions.
- Capability inventory: The included scripts are restricted to console logging and do not perform sensitive operations like file writes or command execution based on the retrieved data.
- Sanitization: The examples do not implement data sanitization, relying on the agent's internal safety guardrails.
Audit Metadata