intercom-conversations

Read Intercom conversations by listing, finding, or searching them using the ConversationsClient with JSON input and output.

Security Scan

The skill's code, docs, and manifest consistently implement a read-only Intercom Conversations client that only requires an Intercom access token; nothing in the package suggests unrelated access or unexpected behavior.

Purpose & Capability

Name/description match the implementation: index.js calls intercom-client to list/find/search conversations. The single sensitive input (INTERCOM_ACCESS_TOKEN) is appropriate for this purpose. Note: the top-level registry summary in the provided metadata said "Required env vars: none", but the skill manifest (clawhub.skill.json) and SKILL.md correctly declare INTERCOM_ACCESS_TOKEN as required — this is a metadata inconsistency to be aware of but does not indicate malicious behavior.

Instruction Scope

SKILL.md instructs the runtime to invoke default(input) and documents the allowed actions. The implementation only calls the Intercom API via intercom-client and does not read local files, other environment variables, or transmit data to any endpoints beyond Intercom. It returns API responses in structured JSON and does not perform additional data collection.

Install Mechanism

There is no formal install spec in the registry, but the package includes package.json and depends on the public npm package intercom-client and the SKILL.md suggests running npm install. This is standard and expected for a Node skill, but installers should be aware that npm will fetch dependencies from the public registry.

Credentials

The skill requires a single credential: INTERCOM_ACCESS_TOKEN, which is proportional and necessary for the stated read-only operations. It does not request unrelated secrets or config paths. Again, be aware of the mismatch between the provided summary (which listed no required envs) and the actual manifest that requires the token.

Persistence & Privilege

always is false and the skill does not attempt to modify other skills or system settings. The module creates a singleton client (keeps token in memory) which is normal for performance; there is no persistent storage or system-wide privilege escalation.

Assessment

This skill appears to do exactly what it claims: read Intercom conversations. Before installing, verify you are comfortable providing an Intercom access token and grant the token only the minimum necessary scope (read-only if possible). Confirm the npm dependency (intercom-client) version is acceptable for your security policy and that running npm install is allowed. Also note the registry metadata summary omitted the required env var — rely on the package's clawhub.skill.json / SKILL.md for the correct requirements. If you do not want the agent to call this skill autonomously, you can disable model invocation for the skill in your agent settings.

Clawhub Skill: Intercom Conversations (Read)

Clawhub loads this Node module and calls default(input).

Required env

• INTERCOM_ACCESS_TOKEN (required)

Install

npm install

Inputs

List

{ "action": "conversations.list", "per_page": 50, "starting_after": "cursor" }

Find

{ "action": "conversations.find", "conversation_id": "123", "display_as": "plaintext" }

Search

{ "action": "conversations.search", "query": { "operator": "AND", "value": [] }, "pagination": { "per_page": 50 } }

Outputs

All successful responses include ok: true and echo the action.

• list/search: { ok, action, conversations, next_starting_after }
• find: { ok, action, conversation }

Errors: { ok: false, error, supported_actions? }

Contracts / metadata

• OpenAPI spec: openapi.yaml
• Skill registry metadata: clawhub.skill.json