indykite-capture-delete-relationship-properties
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Bash helper script (
scripts/capture.sh) that usescurlto interact with the IndyKite API. The script implements security controls such as host-pinning, ensuring that sensitive AppAgent credentials (API_KEY) are only sent to legitimate IndyKite regional endpoints (eu.api.indykite.comorus.api.indykite.com). - [CREDENTIALS_UNSAFE]: The skill manages authentication using the
API_KEYenvironment variable. This aligns with standard secret management practices for AppAgent credentials. The helper script further protects these secrets by redacting them in its--printpreview mode. - [EXTERNAL_DOWNLOADS]: The skill performs network operations via
curlto communicate with the IndyKite REST API. These operations are restricted to the vendor's own infrastructure (indykite.com), representing standard functionality for this skill's purpose.
Audit Metadata