manage-invitations-and-guest-lists
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the official
ticketfairypackage from the NPM registry to provide command-line capabilities. - [COMMAND_EXECUTION]: Uses the
ticketfairyCLI to perform administrative tasks such as brand management and authentication status checks. - [INDIRECT_PROMPT_INJECTION]: The skill processes data that could potentially contain hidden instructions designed to manipulate the agent.
- Ingestion points: Guest list spreadsheets or text lists provided by users, as well as guide content fetched dynamically via the
get_guidetool from the vendor's MCP server. - Boundary markers: Absent. There are no explicit delimiters used to isolate external data from the agent's instructions.
- Capability inventory: The agent can execute shell commands, send automated emails and tickets, and interact with the dashboard assistant (Fai).
- Sanitization: The skill does not specify any validation or sanitization procedures for the data it ingests or the content it fetches.
Audit Metadata