The Agent Skills Directory

[SAFE]: The skill is a standard productivity application for recording and tracking follow-up tasks.
[SAFE]: Sensitive credentials such as BUSABASE_API_KEY are accessed via environment variables in deployment scripts (scripts/setup.mjs, scripts/publish_airapp.mjs) rather than being hardcoded. The skill instructions specifically emphasize avoiding the exposure of keys in browser code or logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted follow-up data (person, action, meeting) ingested from the Busabase backend (busabase-provider.js). It mitigates potential injection risks by consistently applying sanitization via the escapeHtml function in its view logic (followups-views.js). Capabilities are restricted to authorized Busabase operations.
[EXTERNAL_DOWNLOADS]: The skill utilizes standard Node.js libraries and the busabase-sdk, all of which are managed through official package registries. No suspicious or unverified external scripts are downloaded or executed at runtime.
[COMMAND_EXECUTION]: Development and deployment scripts use standard Node.js commands for their intended purposes, such as starting the Hono server or provisioning resources in the backend environment.

kelly-followups