indykite-ciq-delete
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash helper script (scripts/execute.sh) that uses curl to interact with the IndyKite REST API. This is standard functionality for an API-integrated skill.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to the IndyKite regional API endpoints (eu.api.indykite.com and us.api.indykite.com). These are official vendor domains.
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion point for user-supplied input parameters via a JSON file processed in scripts/execute.sh. Boundary markers are absent in the provided templates. Capability inventory includes curl for API requests. Sanitization of the input parameters is handled by the IndyKite API service at runtime.
Audit Metadata