intercom
Fail
Audited by Snyk on Mar 5, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The prompt includes explicit examples that pass tokens verbatim (e.g., intercom login "your_token" and export INTERCOM_ACCESS_TOKEN="your_token"), which instructs generating commands or code that would embed secret values directly and therefore risks secret exfiltration.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill clearly fetches and ingests user-generated Intercom content (e.g., "intercom conversation list/get/search" and "intercom article list/get/search" in SKILL.md and README.md) which the agent is expected to read and act on (reply, assign, close), so untrusted third-party messages could influence tool use and next actions.
Audit Metadata