kinde-authorization
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes a "tenant contract" from the
kinde-b2bskill, creating a surface for indirect prompt injection. However, this is mitigated by structured matrices and workflow gates. - Ingestion points: Data is ingested from the
kinde-b2bskill inSKILL.md(Step 1). - Boundary markers: Present; the skill uses the "Authorization contract" matrices and Step 1 gates to verify the ingested tenant contract.
- Capability inventory: Management API writes for roles and permissions (
PLANES.md) and claim refresh operations (ENFORCEMENT.md). - Sanitization: The skill relies on rigid Markdown schemas for data processing and explicit user confirmation for implementation.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill documentation references Kinde's official Management API and documentation sites. No hardcoded secrets, sensitive local file access, or suspicious network exfiltration patterns were identified.
Audit Metadata