The Agent Skills Directory

[DATA_EXFILTRATION]: The skill uses the busabase-sdk to manage data persistence. It correctly handles user data by explicitly preventing the storage of raw photos in the database, only recording short text descriptions. Credentials are managed securely via local OAuth token storage and environment variables for administrative scripts.
[COMMAND_EXECUTION]: Local management scripts (record_homework.mjs and execute_decisions.mjs) are used to bridge the AI agent's analysis with the database. These scripts are strictly limited to their documented functions and require an explicit --apply flag to execute mutations, preventing unauthorized data modification.
[PROMPT_INJECTION]: The skill processes external student data (photos and text). While this creates an indirect injection surface, the skill implements robust mitigations, including mandatory human review (parent/teacher approval) for all generated explanations and papers, and explicit instructions for the agent to maintain a safe, hint-first tutoring posture.
[EXTERNAL_DOWNLOADS]: The skill relies on standard, version-pinned dependencies such as hono and busabase-sdk from the official NPM registry. No suspicious remote code execution or obfuscated downloads were identified.

kelly-homework-coach