kelly-deal-scorer
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill employs a deterministic scoring model implemented in plain arithmetic (
content/kelly-deal-scorer-app/app/js/scorer-model.js), ensuring that all financial calculations are auditable and free from LLM-related hallucinations or biases. - [SAFE]: Communication with the data backend is handled via a dedicated platform SDK (
busabase-sdk), ensuring that data interactions are structured and scoped to the designated Busabase workspace. - [SAFE]: The review desk interface implements consistent HTML escaping for external candidate data (such as business names and red flags) before rendering, effectively mitigating cross-site scripting (XSS) risks.
- [SAFE]: Administrative operations like seeding mock data and executing final decisions are sequestered into standalone scripts (
scripts/generate_batch.mjs,scripts/execute_decisions.mjs), maintaining a clear boundary between review activity and state-modifying actions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests financing candidate data from external Busabase records, which represents an indirect prompt injection surface. However, the risk is negligible as the scoring logic is non-LLM-based, and all decisions require human-in-the-loop verification via the review dashboard.
Audit Metadata