indykite-capture-delete-node-property-metadata
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bundled shell script,
scripts/capture.sh, which executescurlto interact with the IndyKite API. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data to construct JSON request bodies for the IndyKite Capture API.
- Ingestion points: User input for node identifiers, property names, and metadata field names is used to populate a JSON template.
- Boundary markers: The process relies on the agent's ability to generate correctly formatted JSON. The
scripts/capture.shscript provides a secondary validation step usingjq. - Capability inventory: The skill is capable of writing local JSON files and executing a bundled Bash script that performs network operations via
curl. - Sanitization: The helper script
scripts/capture.shvalidates that the input is a valid JSON object before it is sent to the API endpoint. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with official IndyKite regional API endpoints.
- [SAFE]: The network operations are restricted to vendor-controlled domains (
eu.api.indykite.comandus.api.indykite.com) through a host-pinning mechanism in thescripts/capture.shscript, which prevents credentials from being sent to unauthorized destinations.
Audit Metadata