kelly-money
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a financial ledger dashboard implemented as an AirApp using the Hono framework. The application design separates the data synchronization process from the UI, ensuring the dashboard remains read-only for security.
- [COMMAND_EXECUTION]: The skill includes standard commands for local development and previewing the dashboard via
pnpm --dir app dev, which is consistent with its functionality as a developer tool. - [EXTERNAL_DOWNLOADS]: The application depends on verified packages such as
honoandbusabase-sdk. These are retrieved through standard package managers and are pinned to specific versions to prevent supply chain attacks. - [SAFE]: The skill implements secure credential management by storing OAuth tokens in the user's home directory (~/.busabase/airapps) using restricted file permissions (0600) to prevent unauthorized access.
- [SAFE]: Comprehensive HTML escaping is applied to all transaction and account metadata before it is rendered in the UI, effectively mitigating risks of Cross-Site Scripting (XSS) or indirect injection from external financial data.
Audit Metadata