indykite-authzen-search-resource

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a bash script scripts/search-resource.sh that utilizes curl and jq to interact with the IndyKite REST API. It includes validation to ensure only well-formed JSON is processed.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates network communication with IndyKite's regional API endpoints (eu.api.indykite.com and us.api.indykite.com) to perform its primary function of resource searching.
  • [DATA_EXFILTRATION]: The skill transmits subject and action data to IndyKite's infrastructure. The accompanying script implements a security check that restricts credential transmission exclusively to official IndyKite domains, preventing potential exfiltration to unauthorized hosts.
  • [CREDENTIALS_UNSAFE]: The skill utilizes environment variables for handling sensitive tokens (API_KEY, BEARER_TOKEN). The script is designed with a --print function that explicitly redacts these secrets, preventing accidental exposure in command logs or terminal output.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 05:35 PM
Security Audit — agent-trust-hub — indykite-authzen-search-resource