indykite-authzen-list-policies
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a shell script
scripts/list-policies.shthat executes thecurlcommand to interact with the IndyKite REST API. This script implements security best practices, such as host pinning and input validation, to ensure safe execution. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface through the processing of JSON authorization policies.
- Ingestion points: Data enters the system via the
GET /access/v1/policiesAPI response inscripts/list-policies.sh. - Boundary markers: The skill instructions utilize
jqrecipes for structured data extraction, which helps maintain a boundary between data and instructions. - Capability inventory: The skill employs
curlfor network requests andjqfor JSON processing. - Sanitization: The shell script validates the
subject_typeargument against a strict regular expression (^[A-Za-z_][A-Za-z0-9_]{1,63}$) before it is used in the network request.
Audit Metadata