The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses pnpm create @nocobase/app@beta to bootstrap a new project. This involves downloading and executing code from the official NocoBase npm packages. As these are resources from the skill's own author, this represents standard vendor functionality for project initialization.
[EXTERNAL_DOWNLOADS]: Fetches templates and dependencies from the public npm registry (registry.npmjs.org) or a user-defined NOCOBASE_REGISTRY. These operations are transparently managed via the package manager and target well-known registries.
[COMMAND_EXECUTION]: Executes common development CLI tools such as node, pnpm, and curl. These are used appropriately for environment verification (node --version), project setup, and verifying the health of the local development server.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read AGENTS.md and related skill files that are generated as part of the new project. While this ingests external content into the agent's context, the risk is localized to the development environment created by the initialization tool.
[CREDENTIALS_UNSAFE]: Includes robust instructions for secret management. It explicitly forbids the agent from asking for passwords or printing secrets in the console, instead mandating the use of environment variables and the --from-env flag for configuration updates.

nocobase-create-app