kelly-family-office
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_&_EXFILTRATION]: The application handles sensitive financial data and credentials. Analysis shows that the local server (server.js) correctly restricts data proxying to the configured Busabase origin. The OAuth implementation in 'busabase-oauth-node.js' correctly stores credentials in the user's home directory with restricted file permissions (octal 600/700), preventing unauthorized local access.
- [INDIRECT_PROMPT_INJECTION]: The application ingests external data (asset names, symbols, and entity names) from Busabase or CSV files. The implementation in 'app.js' and 'accent-theme.js' uses a robust 'escapeHtml' function to sanitize all interpolated content before rendering it in the UI, effectively mitigating risks associated with malicious data payloads.
- [COMMAND_EXECUTION]: The skill includes a trusted utility script 'scripts/import_csv.mjs' for administrative data tasks. This script is intended for manual execution by the user and does not expose a remote execution surface to the AI agent.
- [REMOTE_CODE_EXECUTION]: Dependencies are pinned to specific versions ('busabase-sdk@0.11.0'), and the project includes automated checks ('app/scripts/check.mjs') to ensure dependency integrity and prevent the inclusion of retired or unauthorized code patterns.
Audit Metadata