The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash script (scripts/evaluate-batch.sh) to execute curl for interacting with the AuthZEN API. The script is well-structured, utilizing shell arrays to handle arguments safely and preventing command injection vulnerabilities.
[DATA_EXFILTRATION]: The skill transmits authentication tokens (API_KEY and BEARER_TOKEN) to remote endpoints. The provided script includes a critical security check that pins the target API_URL to known vendor domains (eu.api.indykite.com or us.api.indykite.com), ensuring that sensitive credentials are not sent to unauthorized hosts. It also features a --print option that redacts these tokens to prevent credential leakage in command output or logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data to build JSON request bodies for batch evaluation.
Ingestion points: Data enters the system via JSON files or standard input processed by the evaluate-batch.sh script.
Boundary markers: The instructions do not explicitly mandate delimiters or escaping when interpolating user-provided identifiers into the JSON request structure.
Capability inventory: The skill possesses the ability to read files and perform network requests via cat, jq, and curl in the provided script.
Sanitization: The evaluate-batch.sh script employs jq to validate the integrity and format of the JSON request body before transmission, mitigating risks associated with malformed data payloads.

indykite-authzen-evaluations