Skills
Navigate
skills/indykite/skills/indykite-capture-delete-relationships/Gen Agent Trust Hub

indykite-capture-delete-relationships

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides a bash helper script, scripts/capture.sh, which executes curl to interact with the API and jq to validate the JSON payload structure.
  • [DATA_EXFILTRATION]: The skill transmits data to eu.api.indykite.com and us.api.indykite.com. These are verified official endpoints for the IndyKite service and represent intended vendor communication.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied node and relationship identifiers to build an API request body, creating a potential surface where malicious data could attempt to influence the agent's behavior.
  • Ingestion points: User-provided external IDs and relationship types as described in SKILL.md.
  • Boundary markers: No explicit prompt delimiters or instructions to ignore embedded commands are present in the skill text.
  • Capability inventory: Network communication via curl and local file reading via cat within scripts/capture.sh.
  • Sanitization: The scripts/capture.sh utility uses jq to ensure the generated payload is a valid JSON object before transmission.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:03 AM