kelly-behavior-predict

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes several Node.js scripts for environment setup and data management. scripts/generate_batch.mjs generates deterministic mock session data and seeds it into the database. scripts/setup.mjs and scripts/publish_airapp.mjs are used to provision the necessary database folders and deploy the web dashboard (AirApp) to the Busabase platform. These commands are integral to the skill's primary purpose and do not perform unauthorized actions.
  • [EXTERNAL_DOWNLOADS]: The skill relies on the busabase-sdk to interact with the Busabase cloud service (defaulting to busabase.com). This is a functional requirement for data persistence and dashboard hosting. The interaction is limited to the skill's defined resources and utilizes standard authentication patterns via environment variables for administrative scripts.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Busabase records which are then rendered in a dashboard. The implementation includes sanitization measures, such as escapeHtml in app.js and normalizeFields in busabase-provider.js, to mitigate risks associated with processing potentially untrusted data from the database.
  • [REMOTE_CODE_EXECUTION]: No patterns of arbitrary or remote code execution from unknown sources were found. The skill's behavior-model is entirely deterministic and rule-based, implemented as a static set of if/else logic in behavior-model.js rather than relying on external models or dynamic evaluation of untrusted strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 10:35 AM
Security Audit — agent-trust-hub — kelly-behavior-predict