kelly-lesson
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from curriculum materials and teacher-drafted lesson plans. \n
- Ingestion points: The
scripts/ingest_plan.mjsscript parses external JSON and document data into structured records. \n - Boundary markers: Instructions direct the agent to analyze content rather than execute it, and data is partitioned into specific JSON schema fields. \n
- Capability inventory: The skill can write to the Busabase API and perform local file exports via
scripts/export_plans.mjs. \n - Sanitization: UI rendering logic in
lesson-views.jsutilizesescapeHtmlto prevent cross-site scripting (XSS) from processed content. \n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages authentication credentials in~/.busabase/airapps. It leverages thebusabase-sdkwhich enforces restrictive owner-only file permissions to protect these secrets. \n- [COMMAND_EXECUTION]: Several local scripts (ingest_plan.mjs, run_checks.mjs, execute_decisions.mjs, export_plans.mjs) execute shell-level operations for data ingestion, auditing, and document export. \n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The project uses verified Node.js packages such as hono and busabase-sdk. A dedicated check script ensures all critical dependencies remain exact-pinned to safe versions.
Audit Metadata