Security audit
Intercom Support Channel
Security checks for vulnerabilities and agentic risk
Overview
This is a clearly disclosed Intercom support-channel plugin that can autonomously answer and manage customer conversations, so it needs careful configuration but does not show deceptive or unrelated behavior.
Install only with an Intercom token scoped to the workspace and permissions you intend this bot to use. Start with allowedChannels and allowFrom for a pilot, review defaults like pickupUnassigned, autoClose, createMissingTags, contactContext, and maxConcurrentConversations, and be aware that customer profile details and attachments may be sent through your configured model/media and memory integrations.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.