freshdesk-automation
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting untrusted data from ticket descriptions, notes, and conversation history.
- Ingestion points: Untrusted external content enters the agent's context through tools such as FRESHDESK_VIEW_TICKET, FRESHDESK_GET_TICKETS, and FRESHDESK_LIST_ALL_TICKET_CONVERSATIONS defined in SKILL.md.
- Boundary markers: The skill does not provide instructions to use delimiters or delimiters themselves to separate untrusted customer data from system prompts.
- Capability inventory: The agent has the capability to perform state-changing operations including FRESHDESK_REPLY_TO_TICKET and FRESHDESK_UPDATE_TICKET which could be abused if the agent follows instructions embedded in ticket bodies.
- Sanitization: There is no evidence of validation or sanitization for HTML content or embedded instructions in the processed data.
- [EXTERNAL_DOWNLOADS]: The skill facilitates connection to an external MCP endpoint to retrieve tool schemas and execute helpdesk operations.
- Evidence: The setup instructions in SKILL.md direct users to configure an MCP server using the URL https://rube.app/mcp.
Audit Metadata