run-event-accreditation

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the ticketfairy package from the npm registry.
  • Evidence: npm install -g ticketfairy in SKILL.md. This is the official CLI for the Ticket Fairy platform.
  • [COMMAND_EXECUTION]: The skill provides specific command-line instructions for an agent to manage event accreditation, including listing and issuing passes, brand management, and authentication.
  • Evidence: Commands such as ticketfairy event-os passes list <EVENT_ID>, ticketfairy auth status, and ticketfairy login are referenced in SKILL.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection as it processes external content from Ticket Fairy guides and API responses.
  • Ingestion points: The agent is instructed to fetch documentation from https://www.ticketfairy.com/docs/mcp and execute CLI tools that return API data.
  • Boundary markers: The skill includes specific instructions to follow documented steps rather than guessing and to keep secrets out of the conversation.
  • Capability inventory: The agent can list and issue passes, modify brand settings, and send emails via the CLI and MCP tools.
  • Sanitization: While static sanitization isn't defined, the skill mandates a human-in-the-loop for every change, requiring explicit user confirmation for actions like issuing passes or sending emails.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 10:46 PM