indykite-authzen-search-action
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill does not contain any malicious patterns or indicators of compromise. It is a legitimate tool for interacting with IndyKite services.\n- [COMMAND_EXECUTION]: The skill executes
curlandjqvia a Bash script. Security is maintained through host-pinning, which ensures that API keys and bearer tokens are only sent to verified IndyKite endpoints, and through the use of array-based command execution to prevent shell injection.\n- [DATA_EXFILTRATION]: Potential exfiltration is mitigated by strict host validation in the helper script, ensuring sensitive credentials are not sent to unauthorized external domains.\n- [CREDENTIALS_UNSAFE]: Authentication is handled correctly using environment variables. The helper script includes logic to redact these credentials when printing commands, preventing accidental exposure in logs or terminal output.
Audit Metadata