manage-orders-and-refunds

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources that could potentially contain malicious instructions intended to influence the agent's behavior.
  • Ingestion points: Data is ingested via search_guides and get_guide tools from the Ticket Fairy MCP server, as well as through CLI outputs when listing or retrieving order and ticket details.
  • Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious embedded content within the ingested data.
  • Capability inventory: The skill possesses capabilities to modify event settings, update ticket information, and process refunds via the ticketfairy CLI and the internal dashboard assistant (Fai).
  • Sanitization: No explicit sanitization or validation of the external content is mentioned before it is processed or presented to the user.
  • [COMMAND_EXECUTION]: The skill relies on the ticketfairy command-line interface to perform administrative tasks such as authenticating, listing brands, and updating event or ticket configurations.
  • [EXTERNAL_DOWNLOADS]: The instructions direct the user to install the official ticketfairy package from the NPM registry and connect to a remote MCP server hosted at https://www.ticketfairy.com/docs/mcp for guide retrieval.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 05:38 PM