read-event-reports
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and guide content from the official Ticket Fairy MCP endpoint (https://www.ticketfairy.com/docs/mcp). It also references the official 'ticketfairy' package on NPM. These are legitimate resources provided by the vendor.
- [COMMAND_EXECUTION]: The skill utilizes the official 'ticketfairy' CLI to retrieve event statistics, list customers, and manage brand settings. These operations are within the expected scope of a vendor-provided management tool.
- [INDIRECT_PROMPT_INJECTION]: There is an attack surface where external guide content is ingested via the 'get_guide' tool. However, the risk is mitigated as the source is the official vendor documentation. The skill also explicitly instructs the agent to confirm all actions with the user and avoid handling sensitive data like passwords or tokens in the conversation.
- [CREDENTIALS_SAFE]: The skill suggests using a Personal Access Token stored in the 'TICKET_FAIRY_API_KEY' environment variable, which is a standard and safe practice for secret management. It correctly advises against entering credentials directly into the chat.
Audit Metadata