use-vault-and-capital
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the official Ticket Fairy command-line interface using the command
npm install -g ticketfairy. This is a legitimate resource from the software vendor. - [COMMAND_EXECUTION]: The agent uses the
ticketfairyCLI to manage brand accounts, retrieve Vault card details, and list financial transactions. The skill specifies the use of--output jsonand--non-interactiveflags to ensure predictable and safe program execution. - [INDIRECT_PROMPT_INJECTION]: The skill fetches instructions and procedural guides from an external vendor-controlled MCP server to determine how to perform specific tasks.
- Ingestion points: Data is retrieved dynamically using the
get_guidetool from the vendor's documentation endpoint athttps://www.ticketfairy.com/docs/mcp. - Boundary markers: The skill does not define explicit delimiters for external content but instructs the agent to follow the retrieved guide steps exactly without guessing from memory.
- Capability inventory: The agent can execute CLI commands, manage card spending limits, and prepare payment batches for approval.
- Sanitization: No specific sanitization or filtering of the guide content is mentioned, but the skill requires the agent to wait for explicit user confirmation before making any changes.
Audit Metadata