email-and-market-to-buyers
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the official Ticket Fairy CLI tool via
npm install -g ticketfairy. This is a standard installation of a vendor-provided tool required for the skill's functionality. - [COMMAND_EXECUTION]: The skill executes several commands via the
ticketfairyCLI and an MCP server, includingauth status,brand list,event get, andmessaging send. These commands are scoped to the vendor's platform. - [DATA_EXPOSURE]: The skill manages authentication using a Personal Access Token (
TICKET_FAIRY_API_KEY) orticketfairy login. It contains explicit instructions for the agent to avoid placing secrets in the chat context and to rely on secure dashboard inputs instead. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves instructions and guides dynamically from the vendor's endpoint at
https://www.ticketfairy.com/docs/mcp. While this introduces external data into the agent's context, it originates from the official vendor infrastructure.
Audit Metadata