nocobase-app-plugin-development
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a utility script
scripts/verify-testing-example.mjsused to verify the provided example plugin. It executes standard development tools like ESLint, TypeScript, and Vitest usingspawnSync. These operations are limited to the developer's local environment and serve a legitimate purpose. - [CREDENTIALS_UNSAFE]: Hardcoded dummy secrets and passwords are present in
assets/testing-example/test fixtures (e.g.,reading-list-test-password). These are used exclusively for isolated local testing and do not represent a leak of production credentials. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill reads and modifies local plugin source files in the NocoBase workspace (e.g.,
SKILL.md,references/). - Boundary markers: Delimiters are not explicitly mentioned for general file reading instructions.
- Capability inventory: File system writes, command execution via
pnpm, and the use of theverify-testing-example.mjsutility. - Sanitization: The skill advocates for strict input validation using
zodand provides guidance on safe error reporting viaApiErrorin its HTTP API references.
Audit Metadata