Trust Assessment
intercom received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Potential JSON Injection in `curl` data payloads, Potential URL Path Injection in `curl` command.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential JSON Injection in `curl` data payloads The `SKILL.md` provides `curl` examples that use JSON payloads with placeholders (e.g., `email`, `name`, `body`, `ADMIN_ID`, `USER_ID`). If an AI agent directly interpolates untrusted user input into these JSON fields without proper escaping, an attacker could inject arbitrary JSON, potentially altering the request's intent, spoofing identities, or causing unexpected behavior in the Intercom API. This pattern is observed in 'Search Contacts', 'Create Contact', 'Send Message', and 'Reply to Conversation' examples. When constructing `curl` commands with user-provided data for JSON payloads, ensure all user input is properly JSON-escaped before insertion. Use a robust JSON serialization library function to handle user input safely. | LLM | SKILL.md:20 | |
| MEDIUM | Potential URL Path Injection in `curl` command The `Reply to Conversation` `curl` example includes a placeholder `{id}` in the URL path (`https://api.intercom.io/conversations/{id}/reply`). If an AI agent directly interpolates untrusted user input into this path segment without proper URL encoding or validation, an attacker could potentially manipulate the API endpoint being called, leading to unintended actions or access to unauthorized resources if the Intercom API is vulnerable to such path manipulations. When constructing `curl` commands with user-provided data for URL paths, ensure all user input is properly URL-encoded and validated against expected formats (e.g., integer IDs) before insertion into the URL. | LLM | SKILL.md:47 |
Scan History
Embed Code
[](https://skillshield.io/report/f011fa7339f4bac8)
Powered by SkillShield