The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash script (scripts/search-resource.sh) to execute curl commands. The script includes security measures such as validating the API_URL against a whitelist of official IndyKite domains (eu.api.indykite.com and us.api.indykite.com) to prevent sensitive data from being sent to unauthorized hosts.
[CREDENTIALS_UNSAFE]: Authentication credentials (API_KEY and BEARER_TOKEN) are handled via environment variables, adhering to standard security practices for local tools. The script includes a --print function that explicitly redacts these secrets, ensuring they are not exposed if a user previews the command.
[DATA_EXFILTRATION]: No patterns of data exfiltration were detected. The skill's network operations are constrained to the vendor's own infrastructure, and the host-validation logic prevents the redirection of requests containing API keys to arbitrary external domains.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON search requests which could theoretically contain untrusted data.
Ingestion points: scripts/search-resource.sh (lines 52-59) reads input from files or stdin.
Boundary markers: The skill uses JSON structural separation but does not include explicit natural language boundary markers.
Capability inventory: The script performs network POST requests using curl (lines 89-91).
Sanitization: The script validates input using jq (lines 62-65) to ensure it is valid JSON before transmission, mitigating simple injection attacks.

indykite-authzen-search-resource