kelly-app-skill-creator-tests
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of local application servers, headless browser instances for UI acceptance testing, and pinned vendor tools like the Busabase server on random loopback ports.
- [EXTERNAL_DOWNLOADS]: The workflow involves running frozen installations and checks using standard package managers, which may download dependencies from official registries.
- [CREDENTIALS_SAFE]: The skill manages sensitive environment variables such as KELLY_APP_CLOUD_TEST_PASSWORD and OAuth tokens. It implements rigorous safeguards, including the use of temporary HOME directories, mandatory session revocation at teardown, and strict requirements to never log secrets or include them in screenshots.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data including application source code and package metadata which could theoretically serve as an injection vector.
- Ingestion points: Reads contents from
skills/*/app/package.jsonand the<skill-root>/app/project directory. - Boundary markers: The instructions do not define specific delimiters for untrusted code content, but treat the app source as a constrained input for verification logic.
- Capability inventory: The agent can spawn subprocesses for testing, perform network operations for Cloud verification, and write failure diagnostic files to the filesystem.
- Sanitization: Secret redaction is enforced for all output artifacts (logs, screenshots, diagnostics), effectively neutralizing the risk of accidental credential exfiltration during the processing of these inputs.
Audit Metadata