skills/theticketfairy/developer-integration-skills/build-with-the-ticketfairy-api/Gen Agent Trust Hub
build-with-the-ticketfairy-api
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a command-line interface (
ticketfairy) to perform account management, token rotation, and webhook configuration. It explicitly instructs the agent to use non-interactive mode and JSON output for compatibility with automated environments. - [EXTERNAL_DOWNLOADS]: The skill directs the user to install the
ticketfairypackage from the official NPM registry and utilizes an MCP server hosted athttps://www.ticketfairy.com/docs/mcp. These are official resources provided by the vendor. - [INDIRECT_PROMPT_INJECTION]: The skill consumes external content by fetching guides and documentation through an MCP server, which represents a potential attack surface if the remote content is compromised.
- Ingestion points: External documentation fetched via
search_guidesandget_guidetools from the vendor's MCP server. - Boundary markers: The instructions state "Follow those steps; do not guess the dashboard from memory," emphasizing reliance on the fetched content.
- Capability inventory: The agent can install software, execute CLI commands for account management, and manage webhooks.
- Sanitization: No explicit sanitization or escaping of the remote guide content is documented in the skill instructions.
Audit Metadata