Skills
Navigate
skills/mr-kelly/skills/busabase-community/Gen Agent Trust Hub

busabase-community

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill is configured to access sensitive environment files in the user's home directory to retrieve API tokens.
  • Evidence: The envSearchPaths function in scripts/community.mjs includes paths to ~/.config/busabase-community/.env and ~/.busabase/.env to load secrets.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from a community forum, which is an untrusted external source that could contain embedded malicious instructions.
  • Ingestion points: Forum posts and replies are retrieved via GET requests in the posts and post <slug> command implementations in scripts/community.mjs.
  • Boundary markers: The skill instructions do not define boundary delimiters or provide the agent with specific guidance to ignore instructions found within the forum data.
  • Capability inventory: The skill has the capability to write to the forum (new, reply), upload files (upload), and perform moderation tasks (admin).
  • Sanitization: External content from the API is presented to the agent without sanitization or filtering to detect or neutralize potential prompt injection attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 03:42 AM