work-with-fai
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes task-specific instructions fetched from an external vendor-controlled source.
- Ingestion points: Detailed guides are retrieved at runtime via the
get_guidetool from the Ticket Fairy documentation server athttps://www.ticketfairy.com/docs/mcp. - Boundary markers: The instructions do not define explicit delimiters to isolate external guide content from the core system prompt.
- Capability inventory: The skill is capable of executing shell commands via the
ticketfairyCLI, including creating ticket tiers and issuing guest tickets. - Sanitization: The skill relies on the integrity of the official vendor documentation and does not mention explicit sanitization of the fetched Markdown content.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
ticketfairypackage from the official NPM registry, which is the legitimate tool provided by the vendor. - [COMMAND_EXECUTION]: The skill facilitates the use of the
ticketfairyCLI for account management, event statistics, and ticket configuration.
Audit Metadata