indykite-ciq-create-node-with-link
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a bash utility (
scripts/execute.sh) and documentation examples that usecurlandjqto interact with the IndyKite REST API for policy configuration and query execution. - [INDIRECT_PROMPT_INJECTION]: The skill accepts external input parameters which are included in the API request payload, creating a potential surface for indirect manipulation.
- Ingestion points: External data enters through the
input_paramsvariable in thescripts/execute.shscript. - Boundary markers: The skill does not implement specific delimiters to isolate user-provided data within the request body.
- Capability inventory: Authorized network requests to the IndyKite REST API via
curl. - Sanitization: Input is interpolated into a JSON body using string formatting without explicit validation or escaping.
- [SAFE]: All network endpoints belong to the vendor's official domains (indykite.com). Authentication tokens and project identifiers are managed through environment variables and placeholders, adhering to secure development standards.
Audit Metadata