kelly-brand
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes official NPM packages, including
busabase-sdkandhono, to facilitate data synchronization and local workbench functionality. These dependencies are standard for the application's design.- [COMMAND_EXECUTION]: The skill includes administrative scripts, such asexecute_decisions.mjsandsetup.mjs, which are used to initialize the workspace and promote approved narrative items. These scripts run locally and interact with the database via a controlled SDK, with no detected command injection vectors.- [DATA_EXFILTRATION]: Brand narrative data and drift alerts are synchronized with the Busabase platform. This data transfer is the intended purpose of the skill and uses secure credential management via environment variables.- [PROMPT_INJECTION]: The skill processes external channel data to monitor for brand drift. This untrusted content is sanitized using HTML escaping (escapeHtml) before being displayed in the review interface, and all automated suggestions require human confirmation before adoption.
Audit Metadata