busa-cms
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill implements a secure architecture where API credentials remain on the server side. The AirApp component uses an OAuth flow and a server-side proxy (content/busa-cms-app/server/local-auth.js) to interact with the Busabase API, preventing the exposure of workspace keys to the client-side browser environment.
- [INDIRECT_PROMPT_INJECTION]: The skill manages user-generated content which acts as an ingestion surface for untrusted data. To mitigate potential risks during content preview, it includes a robust, allowlist-based HTML sanitizer (content/busa-cms-app/app/js/sanitize.js) that strips dangerous tags and attributes, preventing stored XSS or malicious script execution within the CMS admin interface.
- [COMMAND_EXECUTION]: The application code includes a directory traversal check (content/busa-cms-app/server/hono.js) in its static file server to ensure that requested paths do not escape the application directory, demonstrating a high standard of defensive programming.
Audit Metadata