kelly-portfolio-health
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill manages OAuth credentials in a local directory (~/.busabase/airapps) using restrictive file permissions (0600) to ensure security.
- [INDIRECT_PROMPT_INJECTION]: The application ingests and displays data from an external database (Busabase). It implements comprehensive HTML sanitization using an escapeHtml utility to mitigate potential injection risks when rendering business names and notes.
- [COMMAND_EXECUTION]: The project includes build-time scripts in package.json that use esbuild to bundle required SDKs for the client-side application, which is a standard development practice.
- [EXTERNAL_DOWNLOADS]: The skill uses well-known, version-pinned dependencies such as hono and busabase-sdk for its web server and data integration functionality.
Audit Metadata