kelly-demo-video-factory
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several utility scripts (
scripts/*.mjs) for schema setup, record management, and status tracking. These scripts are intended for local execution by the user or agent to manage the video production pipeline and do not perform unauthorized or hidden actions. - [CREDENTIALS_SAFE]: The skill uses environment variables (e.g.,
BUSABASE_API_KEY,KELLY_VIDEO_FACTORY_BUSABASE_API_KEY) to manage authentication with the Busabase backend. No hardcoded secrets were found in the source code or instructions. - [INDIRECT_PROMPT_INJECTION]: While the skill ingests data from external Busabase records and JSON outline files, the
SKILL.mdinstructions explicitly direct the agent to treat this content as data rather than instructions. The accompanying AirApp is configured as read-only, further limiting the risk surface. - [EXTERNAL_DOWNLOADS]: The skill relies on standard dependencies, including
busabase-sdk,hono, andesbuild-wasm. Deployment and publishing scripts (setup.mjs,publish_airapp.mjs) are used to upload the skill's own application code to the user-configured Busabase instance, which is a core part of its intended deployment architecture.
Audit Metadata