indykite-capture-upsert-relationships
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/capture.shusescurlandjqto process data. It includes a host-pinning check that restricts network operations to official IndyKite API domains, preventing accidental or malicious redirection of sensitive credentials. - [EXTERNAL_DOWNLOADS]: The skill connects to IndyKite regional APIs for data ingestion. These operations target trusted vendor-controlled infrastructure.
- [CREDENTIALS_UNSAFE]: The skill handles an API key via environment variables. The associated shell script provides a --print mode that redacts the key, ensuring it is not exposed in logs or console output during testing.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-defined entity and relationship information to build API requests.
- Ingestion points: Data modeled in
SKILL.md(Steps 1 & 2) for relationship properties. - Boundary markers: Not explicitly defined, relying on structured JSON format.
- Capability inventory: Use of
curlandjqwithin the provided shell script. - Sanitization: The script uses
jqto ensure the generated payload is a valid JSON object before it is sent to the API.
Audit Metadata