The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes management scripts (scripts/publish_airapp.mjs and scripts/setup.mjs) that use the busabase-sdk to provision resources. These scripts execute in the user's local environment and require credentials provided via environment variables (BUSABASE_API_KEY, BUSABASE_BASE_URL), following standard secure practices for CLI tooling.\n- [DATA_EXPOSURE]: The application handles financial scenario data intended for analyst review. Sensitive operations, such as deleting records or merging changes, are governed by an environment-aware runtime check (isStandaloneLocalRuntime). This logic differentiates between a local trusted environment (where auto-merge is allowed) and a deployed environment (where manual review is required), maintaining appropriate privilege boundaries.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for scenario names, business types, and underwriting notes. While these are potential ingestion points for indirect prompt injection, the application implements consistent HTML sanitization using an escapeHtml utility before rendering data in the UI, and the impact on the agent is mitigated by standard platform guardrails.\n- [EXTERNAL_DOWNLOADS]: Dependencies are managed via standard package managers (pnpm, npm) and include well-known libraries such as hono and the busabase-sdk. Build-time tools like esbuild-wasm are used for bundling client-side assets, which is a routine development practice.

kelly-revshare-simulator