kelly-education-intel
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external education news and policy sources, which constitutes a theoretical attack surface for indirect prompt injection. However, this is mitigated by a mandatory manual review gate in the AirApp UI.
- Ingestion points: Public education bureau news, exam board updates, and competitor movement (documented in
SKILL.md). - Boundary markers: The skill requires human approval, blocking, or revision of every item before it is finalized (
README.md,SKILL.md). - Capability inventory: The skill writes records to a Busabase workspace and provides a script for dry-running decision execution (
scripts/execute_decisions.mjs). - Sanitization: External content is sanitized using
escapeHtmlwithin the UI rendering logic (content/kelly-education-intel-app/app/app.js). - [COMMAND_EXECUTION]: The skill includes administrative scripts for workspace setup, deployment, and decision recording (
scripts/setup.mjs,scripts/publish_airapp.mjs,scripts/execute_decisions.mjs). These tools are designed for local operator use, requiring specific environment variables and explicit user-triggered flags (--apply) to execute changes. - [SAFE]: The skill follows secure credential management practices; instructions explicitly forbid storing API keys or credentials in the database, and scripts rely on environment variables rather than hardcoded secrets.
- [SAFE]: All dependencies are standard, well-known libraries for web server functionality (Hono) and database interaction (busabase-sdk).
Audit Metadata