indykite-authzen-search-subject
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (
scripts/search-subject.sh) to executecurlcommands against the IndyKite API. The script includes a security validation step that pins the targetAPI_URLto authorized IndyKite regional hosts, preventing credentials from being sent to arbitrary or malicious domains. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and displays data from external API responses.
- Ingestion points: Data enters the environment via the output of the
POST /access/v1/search/subjectcall inscripts/search-subject.sh. - Boundary markers: The skill relies on structured JSON formatting for the API response.
- Capability inventory: The skill utilizes
curlfor network operations andjqfor JSON processing. - Sanitization: The shell script performs JSON validation using
jqon the request body before transmission, ensuring only well-formed data is processed.
Audit Metadata