The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The application processes contract, obligation, and approval data retrieved from external Busabase records. To prevent potential injection or cross-site scripting through this data, the application utilizes a sanitization utility e() in content/kelly-clm-app/app/app.js to escape HTML special characters before they are rendered in the browser UI.
[CREDENTIALS_UNSAFE]: The skill's administrative and deployment scripts, such as scripts/setup.mjs and scripts/publish_airapp.mjs, are correctly designed to retrieve sensitive information like BUSABASE_API_KEY from environment variables, avoiding the risk of hardcoded credentials.
[COMMAND_EXECUTION]: The provided scripts for local development and workspace setup use standard Node.js and pnpm commands to perform specific, documented tasks. There is no evidence of arbitrary shell execution or patterns that would allow for command injection.
[EXTERNAL_DOWNLOADS]: All external dependencies are standard, well-known libraries sourced from official registries, including the Hono web framework and esbuild-wasm for bundling, ensuring a transparent supply chain.

kelly-clm