intercom
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The React component in
SKILL.mddynamically loads the Intercom messenger script fromhttps://widget.intercom.io. This is a well-known service and the official domain for Intercom's widget distribution. - [DATA_EXFILTRATION]: The skill includes server-side examples using
fetchto send contact and message data tohttps://api.intercom.io. This behavior is expected for the skill's primary purpose of customer messaging and support. - [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill correctly demonstrates using environment variables (
INTERCOM_ACCESS_TOKENandNEXT_PUBLIC_INTERCOM_APP_ID) to manage sensitive integration tokens. - [SAFE]: Analysis of the instructions and code snippets revealed no signs of prompt injection, obfuscation, persistence mechanisms, or unauthorized privilege escalation.
Audit Metadata