The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The application manages authentication tokens for the Busabase platform through an OAuth flow. These credentials are securely stored in the user's home directory (~/.busabase/airapps) as intended by the platform's architecture. The skill only communicates with the configured Busabase instance and does not attempt to access sensitive system files or send data to unauthorized external domains.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external industry sources (news sites, competitor pages), which represents a known attack surface for indirect prompt injection. The implementation mitigates this by providing the agent with explicit instructions to block medical diagnosis and unsupported claims, and by using the escapeHtml utility in the frontend code to prevent the execution of malicious scripts embedded in the ingested data.- [COMMAND_EXECUTION]: The skill includes a Node.js server implementation in server.js used to host the local preview cockpit. The server is strictly limited to static file serving and API proxying to Busabase; it does not facilitate the execution of arbitrary shell commands or the creation of unauthorized subprocesses.

kelly-beauty-intel