kelly-ideas
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. The skill follows established patterns for AI-driven business tools.
- [DATA_EXPOSURE]: The skill correctly manages sensitive data. API keys and configuration secrets are restricted to server-side environments or local setup scripts and are explicitly guarded against exposure to the browser, logs, or UI screenshots.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of user answers and idea descriptions. It successfully mitigates risk in this category by employing DOMPurify to sanitize all rendered Markdown content, preventing potential Cross-Site Scripting (XSS) attacks.
- [DYNAMIC_EXECUTION]: Visualization tools like Mermaid are used to render diagrams. The application enforces a
securityLevel: "strict"configuration for these tools, preventing the execution of arbitrary JavaScript within diagram definitions. - [COMMAND_EXECUTION]: The provided scripts (
setup.mjs,publish_airapp.mjs) are for standard administrative tasks (provisioning and deployment) and do not contain patterns for arbitrary or malicious command execution.
Audit Metadata