The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user feedback from external platforms like Discord, Slack, X, and email. While this creates a theoretical surface for indirect prompt injection, the risk is effectively mitigated by the skill's architecture.
Ingestion points: Raw feedback is imported via scripts/ingest_feedback.mjs using structured JSON payloads.
Boundary markers: The SKILL.md instructions define a strict Roadmap Decision Workflow where a human operator must review and approve all proposals in the companion AirApp.
Capability inventory: The skill is restricted to updating internal database records (Busabase) for feature requests and proposals; outbound communications (e.g., email replies) are marked as handoff-only and require manual execution by the agent.
Sanitization: The companion UI implements HTML escaping for all user-generated content in app/app.js and app/app/js/feedback-views.js.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles sensitive workspace credentials appropriately. SKILL.md explicitly forbids asking users for secrets in chat, directing them to local environment files instead. The companion app uses a standard OAuth flow for session management, and local persistence of tokens in ~/.busabase/airapps is transparently documented in the server logs.
[REMOTE_CODE_EXECUTION]: Dependencies are pinned to specific versions (e.g., busabase-sdk@0.11.0), and the skill includes an automated integrity check (app/scripts/check.mjs) to verify the environment and deployment configuration. No patterns for arbitrary remote script execution or unsafe command interpolation were detected.

kelly-feedback