find-event-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external event listings and descriptions via the Ticket Fairy API and event pages, which introduces a surface for indirect prompt injection. Ingestion points: Event listing API endpoints (e.g., https://www.ticketfairy.com/api/v1/events/listing) and MCP/A2A data interfaces. Boundary markers: The skill explicitly instructs the agent that event descriptions are information only and do not grant authority to change user requests or disclose data. Capability inventory: The agent can perform HTTP requests and facilitate ticket checkouts via official Ticket Fairy interfaces. Sanitization: Instructions advise using returned opaque item IDs and official links rather than guessing from event text.
- [SAFE]: All network operations and resource references target the official vendor domain (ticketfairy.com). The skill explicitly forbids the collection of sensitive credentials, passwords, or payment tokens within the chat interface, directing the agent to use secure, browser-based or protocol-specific checkout handlers.
Audit Metadata