indykite-ciq-create-relationship
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a bash helper script (
scripts/execute.sh) and documentation examples that utilizecurlandjqto interact with IndyKite service endpoints. This execution is limited to the skill's primary function of managing cloud-based graph resources. - [EXTERNAL_DOWNLOADS]: The skill documentation and scripts facilitate network requests to the official IndyKite regional API servers (
eu.api.indykite.comandus.api.indykite.com). These communications are necessary for the skill's functionality and target verified vendor infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data through
input_paramsto populate API requests, which represents an attack surface for indirect instructions. - Ingestion points: External data enters the agent context via JSON files or standard input processed by the
scripts/execute.shscript. - Boundary markers: The skill does not employ explicit delimiters in the prompt to separate user data from instructions.
- Capability inventory: The skill is capable of performing network operations via
curland file reads viacat. - Sanitization: Documentation instructions recommend the use of
jqto safely assemble JSON payloads, which helps prevent malformed data from influencing the request structure.
Audit Metadata