The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a bash script, scripts/capture.sh, which uses curl to transmit data to IndyKite's regional API endpoints.
Evidence: The script constructs and executes a curl command using provided environment variables (API_URL, API_KEY) and the generated JSON body.
Mitigations: The script implements a security check that restricts the API_URL to known IndyKite hosts (https://eu.api.indykite.com or https://us.api.indykite.com) before attaching the API_KEY header, protecting against credential leakage to unauthorized domains.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied entity identifiers and relationship types to build a JSON payload, representing a potential surface for indirect prompt injection.
Ingestion points: User input defining source, target, and properties fields in SKILL.md.
Capability inventory: The agent has the ability to execute network requests via scripts/capture.sh.
Boundary markers: Instructions direct the agent to produce a structured JSON file.
Sanitization: The scripts/capture.sh script utilizes jq to validate that the input is a well-formed JSON object before transmission, reducing the risk of malformed or malicious payload execution.

indykite-capture-upsert-relationships