indykite-authzen-kbac-policies
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard CLI tools (
curl,bash,jq) to interact with the IndyKite API. These operations are within the stated scope of managing authorization policies. - [EXTERNAL_DOWNLOADS]: The skill interacts with official IndyKite API endpoints (
eu.api.indykite.com,us.api.indykite.com) to manage configuration assets. These are recognized as legitimate vendor resources. - [CREDENTIALS_UNSAFE]: Sensitive information like the
SERVICE_ACCOUNT_TOKENis handled via environment variables. The provided scriptscripts/create-policy.shincludes a proactive security check (host pinning) to ensure the token is only sent to legitimate IndyKite domains, preventing potential exfiltration to malicious hosts. - [SAFE]: The skill follows best practices for secret management and API interaction. The provided policy templates and Cypher query examples are consistent with the documented purpose of the skill and the IndyKite platform's functionality.
Audit Metadata