sell-passes-and-extras
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the official Ticket Fairy CLI (
npm install -g ticketfairy) from the NPM registry. This is the primary tool for the skill's intended functionality and originates from the official vendor. - [COMMAND_EXECUTION]: The instructions detail the use of several CLI commands (e.g.,
ticketfairy auth status,ticketfairy addon create) to perform administrative tasks. The skill includes specific safeguards, such as requiring explicit organiser approval before creating, changing, or cancelling items. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Ticket Fairy documentation via the
get_guideandsearch_guidestools. While this constitutes a vulnerability surface for indirect prompt injection, the risk is mitigated by fetching content exclusively from the official vendor domain and the requirement for human verification before acting on instructions. - [CREDENTIALS_UNSAFE]: The skill mentions the use of API keys (
TICKET_FAIRY_API_KEY) and authentication tokens. However, it follows security best practices by advising that these be stored in environment variables and explicitly warning against including secrets in the conversation logs.
Audit Metadata