run-event-accreditation
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
ticketfairypackage from the npm registry. - Evidence:
npm install -g ticketfairyin SKILL.md. This is the official CLI for the Ticket Fairy platform. - [COMMAND_EXECUTION]: The skill provides specific command-line instructions for an agent to manage event accreditation, including listing and issuing passes, brand management, and authentication.
- Evidence: Commands such as
ticketfairy event-os passes list <EVENT_ID>,ticketfairy auth status, andticketfairy loginare referenced in SKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection as it processes external content from Ticket Fairy guides and API responses.
- Ingestion points: The agent is instructed to fetch documentation from
https://www.ticketfairy.com/docs/mcpand execute CLI tools that return API data. - Boundary markers: The skill includes specific instructions to follow documented steps rather than guessing and to keep secrets out of the conversation.
- Capability inventory: The agent can list and issue passes, modify brand settings, and send emails via the CLI and MCP tools.
- Sanitization: While static sanitization isn't defined, the skill mandates a human-in-the-loop for every change, requiring explicit user confirmation for actions like issuing passes or sending emails.
Audit Metadata