intercom-automation
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to add an external MCP server endpoint (
https://rube.app/mcp) to their agent configuration. This server provides the underlying logic and execution environment for all Intercom tools used by the skill. - [DATA_EXFILTRATION]: By using the Rube MCP service, the skill transmits sensitive Intercom workspace data—such as conversation history, email addresses, and admin identifiers—to the third-party domain
rube.app. The setup process includes an OAuth authentication flow handled by this external service. - [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it retrieves and processes untrusted data from Intercom conversations.
- Ingestion points: The tools
INTERCOM_LIST_CONVERSATIONSandINTERCOM_GET_CONVERSATIONingest message content provided by external users and leads. - Boundary markers: There are no instructions or delimiters specified to prevent the agent from interpreting instructions embedded within retrieved Intercom messages.
- Capability inventory: The agent possesses capabilities to perform state-changing actions based on processed data, such as
INTERCOM_REPLY_TO_CONVERSATION,INTERCOM_ASSIGN_CONVERSATION, andINTERCOM_CLOSE_CONVERSATION. - Sanitization: The skill does not include steps for sanitizing, filtering, or validating message content before the agent processes it.
Audit Metadata