indykite-authzen-kbac-policies
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a shell script (
scripts/create-policy.sh) used to interact with the IndyKite Config API. The script implements security best practices by pinning the API_URL to known IndyKite hosts (eu.api.indykite.com and us.api.indykite.com), preventing the accidental transmission of Service Account tokens to unauthorized endpoints. - [DATA_EXFILTRATION]: The skill performs network operations via curl to transmit policy configurations to the IndyKite API. These operations are restricted to the vendor's official domains and are necessary for the skill's primary function.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill handles policy data such as names, descriptions, and Cypher conditions provided by the user or read from JSON assets.
- Boundary markers: No explicit delimiters are mentioned in the instructions for the agent to use when interpreting user-supplied text.
- Capability inventory: The skill uses curl calls in the create-policy.sh script to send data to the API.
- Sanitization: The management script uses jq with the --arg flag and tojson filter to ensure that policy data is properly escaped before being sent in the JSON payload, mitigating command or JSON injection risks at the API level.
Audit Metadata