read-event-reports
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the official platform CLI (
ticketfairy) from the public NPM registry. This is a standard developer tool for interacting with the Ticket Fairy API. - [COMMAND_EXECUTION]: The instructions provide multiple examples of CLI commands (e.g.,
ticketfairy event stats,ticketfairy customer list) to fetch reporting data. These commands are executed locally by the agent with the user's authorization. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources, specifically the platform's documentation (
ticketfairy.com/docs/mcp) and live event reports. While these are official vendor-controlled sources, processing remote content introduces a surface for indirect prompt injection. The skill mitigates this risk by instructing the agent to follow specific guide steps rather than guessing and requiring user approval for significant actions. - [CREDENTIALS_SAFE]: The skill correctly instructs users to store sensitive API keys in environment variables (
TICKET_FAIRY_API_KEY) and explicitly warns against sharing passwords or tokens within the chat interface.
Audit Metadata