kelly-behavior-predict
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several Node.js scripts for environment setup and data management.
scripts/generate_batch.mjsgenerates deterministic mock session data and seeds it into the database.scripts/setup.mjsandscripts/publish_airapp.mjsare used to provision the necessary database folders and deploy the web dashboard (AirApp) to the Busabase platform. These commands are integral to the skill's primary purpose and do not perform unauthorized actions. - [EXTERNAL_DOWNLOADS]: The skill relies on the
busabase-sdkto interact with the Busabase cloud service (defaulting tobusabase.com). This is a functional requirement for data persistence and dashboard hosting. The interaction is limited to the skill's defined resources and utilizes standard authentication patterns via environment variables for administrative scripts. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Busabase records which are then rendered in a dashboard. The implementation includes sanitization measures, such as
escapeHtmlinapp.jsandnormalizeFieldsinbusabase-provider.js, to mitigate risks associated with processing potentially untrusted data from the database. - [REMOTE_CODE_EXECUTION]: No patterns of arbitrary or remote code execution from unknown sources were found. The skill's behavior-model is entirely deterministic and rule-based, implemented as a static set of if/else logic in
behavior-model.jsrather than relying on external models or dynamic evaluation of untrusted strings.
Audit Metadata