answer-ticketfairy-questions
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content fetched from an external vendor API, which introduces a potential surface for instructions embedded in documentation to influence agent behavior.
- Ingestion points: Content is retrieved from
https://www.ticketfairy.com/docs/mcpusing thesearch_guidesandget_guidetools defined inSKILL.md. - Boundary markers: The instructions do not define explicit delimiters or 'ignore' commands to isolate external guide content from the agent's system instructions.
- Capability inventory: The skill's primary capabilities are limited to searching and reading documentation; it does not explicitly define tools for file system modification or direct network exfiltration.
- Sanitization: There is no mention of sanitization, filtering, or validation performed on the guide content before it is presented to the agent.
Audit Metadata