indykite-capture-delete-relationships
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash helper script (
scripts/capture.sh) that executescurlto send data to the IndyKite API. The script incorporates a security safeguard that pins theAPI_URLto known IndyKite domains (eu.api.indykite.comorus.api.indykite.com), preventing the accidental transmission of credentials to untrusted third-party hosts. - [EXTERNAL_DOWNLOADS]: The skill interacts with external regional API endpoints owned by IndyKite. These communications are directed to official vendor infrastructure and are consistent with the skill's primary purpose.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The provided script manages authentication through environment variables and includes a redaction mechanism to ensure that the
API_KEYis not displayed when the user previews the command using the--printflag. - [DATA_EXFILTRATION]: The skill transmits relationship identifiers to IndyKite APIs. The transmission is protected by a host-validation check in the execution script, ensuring data is only sent to authorized vendor endpoints.
Audit Metadata