indykite-authzen-list-policies
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interacts with the IndyKite REST API to list active authorization policies. All network communication is directed to legitimate vendor-owned domains (eu.api.indykite.com and us.api.indykite.com).
- [SAFE]: The provided bash script (scripts/list-policies.sh) includes a security check that pins the API_URL to known IndyKite hosts. This prevents the agent's credentials (API_KEY) from being accidentally sent to an untrusted external server if the API_URL environment variable is misconfigured.
- [SAFE]: The skill validates user-supplied input for the subject_type parameter using a strict regular expression. This ensures that only valid identifiers are processed, mitigating potential injection risks.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches policy data from an external API source. While this creates an ingestion surface for external content into the agent's context, the data is returned as structured JSON and the skill is limited to a read-only runtime view of the configuration, posing no significant security risk.
Audit Metadata