build-with-the-ticketfairy-api
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the official Ticket Fairy CLI using the command
npm install -g ticketfairy. As this package belongs to the skill's author/vendor, this is standard functional behavior. - [COMMAND_EXECUTION]: The skill provides numerous examples of CLI commands using the
ticketfairytool to manage authentication, brands, and webhooks. These commands include--non-interactiveflags to ensure predictable behavior in automated environments. - [INDIRECT_PROMPT_INJECTION]: The skill utilizes a remote MCP server at
https://www.ticketfairy.com/docs/mcpto fetch guide content viaget_guideandsearch_guidestools. This introduces a surface where instructions are ingested from an external source. - Ingestion points: Guide content retrieved dynamically from
ticketfairy.comvia the MCP tools specified in SKILL.md. - Boundary markers: The skill instructions emphasize following the retrieved guides exactly rather than relying on memory, but do not specify technical delimiters for the ingested content.
- Capability inventory: The agent can execute CLI commands for authentication, brand selection, and webhook management.
- Sanitization: No explicit sanitization of the fetched guide content is described within the skill instructions.
Audit Metadata