busa-demo-video-factory
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a video production pipeline using Busabase as the system of record. It correctly handles sensitive configuration, such as API keys and space IDs, by reading them from environment variables rather than hardcoding them.
- [SAFE]: The dashboard application (AirApp) is designed to be read-only, ensuring that data modifications only occur through authorized scripts that include human review steps or explicit approval flags.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Busabase records to plan storyboards, creating a potential surface for indirect prompt injection. This risk is addressed in the
SKILL.mdboundary rules, which explicitly instruct the agent to treat record fields as data rather than instructions, and the UI includes HTML escaping for safe rendering.
Audit Metadata