kelly-agent-builder
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill operates strictly as a mock configuration environment, ensuring that no real agents, models, or external tools are provisioned or invoked through the governance console.
- [EXTERNAL_DOWNLOADS]: The application utilizes standard, version-pinned dependencies from the NPM registry, such as the Hono web framework and the Busabase SDK, to provide local development and data management capabilities.
- [SAFE]: Credential management for local development environments adheres to security best practices by storing OAuth tokens in restricted directories (e.g., ~/.busabase/airapps) with appropriate file system permissions (0600) to prevent unauthorized access.
- [SAFE]: The governance console implements input sanitization using HTML escaping for agent names and descriptions, effectively preventing cross-site scripting (XSS) within the application's user interface.
- [SAFE]: Data validation is enforced both in the UI and the data provider layer, requiring specific fields to be present and valid before allowing an agent configuration to transition from draft to live status.
Audit Metadata