indykite-ciq-add-property
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the transmission of user-provided data to IndyKite's ContX IQ API via the
scripts/execute.shutility. - Ingestion points: The execution script accepts input parameters from files or standard input.
- Capability inventory: The skill uses
curlto perform network operations and handles sensitive authentication tokens. - Boundary markers: No specific boundary markers or instructions to disregard embedded commands are present in the script's handling of user data.
- Sanitization: The skill lacks client-side validation or sanitization for parameters before they are interpolated into the JSON request payload.
- [COMMAND_EXECUTION]: The skill includes a bash script (
scripts/execute.sh) that utilizescurland other shell utilities to interact with IndyKite's regional API infrastructure. - [DATA_EXFILTRATION]: The skill transmits authentication credentials (
API_KEY,BEARER_TOKEN) to IndyKite's official regional API domains (eu.api.indykite.com,us.api.indykite.com). This transmission is documented as standard operational behavior for interacting with the vendor's platform.
Audit Metadata