indykite-authzen-search-subject
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/search-subject.shexecutescurlto interact with the IndyKite API. It includes a host-pinning mechanism that restricts requests tohttps://eu.api.indykite.comorhttps://us.api.indykite.com, preventing the accidental transmission of API keys or bearer tokens to unauthorized domains. - [DATA_EXFILTRATION]: The skill uses
API_KEYandBEARER_TOKENenvironment variables for authentication. Thescripts/search-subject.shscript specifically redacts these sensitive tokens when the--printflag is used, ensuring that debug or preview logs do not inadvertently leak credentials. - [EXTERNAL_DOWNLOADS]: The skill references official IndyKite domains (
indykite.com) and developer documentation. These are vendor-owned resources and are used appropriately for the skill's primary purpose of searching authorization subjects. - [PROMPT_INJECTION]: No evidence of prompt injection, role-play overrides, or instructions to ignore safety guidelines were found in the markdown or script content.
Audit Metadata