intercom-local-dev-loop
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill promotes security best practices by instructing users to store sensitive credentials, such as the
INTERCOM_ACCESS_TOKEN, in git-ignored.envfiles rather than hardcoding them in the application source code. - [SAFE]: The Base64 encoded strings provided in the examples (e.g.,
dG9rOmRldl90b2tlbl9oZXJl) are intended as placeholders; they decode to the non-sensitive stringtok:dev_token_here, providing realistic examples for educational purposes without exposing actual secrets. - [SAFE]: The skill uses well-known and trusted external services and libraries, including the official
intercom-clientnpm package andngrokfor webhook tunneling, which are standard tools for this development use case. - [SAFE]: The instructions for project scaffolding and package script configuration follow standard development patterns for Node.js environments and do not include any hidden or suspicious command execution.
Audit Metadata