nocobase-ai-builder
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements significant safety measures, including mandatory source backups or Git recovery points before upgrades, and explicit directives to avoid hardcoding secrets or credentials. It also requires reading project-specific instructions (AGENTS.md) before making changes. It identifies a surface for indirect prompt injection via ingestion of local source code and Swagger metadata from the NocoBase API, which is addressed through a structured design and verification workflow. Ingestion points include local files and API metadata; capability inventory includes file writes and CLI execution; sanitization is achieved through final build and browser verification steps.
- [EXTERNAL_DOWNLOADS]: The skill manages source code via
nb portal pullfrom configured repositories and visual foundations fromshadcn.io/theme. These actions are central to the developer workflow and target the vendor's own infrastructure or established services. - [COMMAND_EXECUTION]: The skill invokes the NocoBase CLI (
nb) for tasks such as pulling portal source, reading Swagger documentation, and querying collection metadata. These are necessary operations for designing and verifying a production-ready application.
Audit Metadata