The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a bash script scripts/capture.sh that executes curl to send data to the IndyKite API. The script implements host pinning, ensuring that the API_KEY is only sent to the official IndyKite domains (eu.api.indykite.com or us.api.indykite.com). It includes input validation using jq to ensure the request body is a valid JSON object before execution. A --print flag is provided to allow users to inspect the generated command with sensitive tokens redacted.
[DATA_EXFILTRATION]: The skill performs network operations to send metadata deletion requests. This activity is restricted to the vendor's own infrastructure and is a core part of the skill's documented functionality.
[INDIRECT_PROMPT_INJECTION]: The skill has a potential surface for indirect injection as it processes user input to construct API payloads. (1) Ingestion point: User-provided values for JSON fields in SKILL.md. (2) Boundary markers: The instructions define a strict JSON schema for the request body. (3) Capability inventory: The skill can write files and execute the capture.sh script which uses curl. (4) Sanitization: The capture.sh script uses jq to validate that the constructed payload is a valid JSON object.

indykite-capture-delete-node-property-metadata