nocobase-v3-plugin-development
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of UI components from the official NocoBase registry (ui.nocobase.com) using the shadcn CLI. These are trusted vendor-managed resources.
- [COMMAND_EXECUTION]: The skill instructs the agent to use the pnpm package manager and the nocobase CLI for scaffolding and lifecycle management. These are standard operations for plugin development.
- [INDIRECT_PROMPT_INJECTION]: The skill involves reading workspace files to guide code generation, creating a standard indirect prompt injection attack surface. * Ingestion points: Workspace files such as pnpm-workspace.yaml and plugin manifests (referenced in SKILL.md). * Boundary markers: None identified. * Capability inventory: File system writes and CLI execution via pnpm (referenced in SKILL.md). * Sanitization: Not explicitly implemented.
- [NO_CODE]: No executable scripts are included in the skill package; it consists entirely of documentation and configuration files.
Audit Metadata