nocobase-ai-employee

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements strict 'Safety Gates' requiring explicit human confirmation for high-impact actions like deleting custom employees or changing identity settings.
  • [SAFE]: It enforces a 'Non-Developer' restriction, preventing the exposure of internal system employees (e.g., nathan, dara) to business users, which mitigates privilege escalation risks.
  • [SAFE]: The skill uses a 'Safe-Field Contract' that explicitly lists allowed writable fields and mandates the rejection of protected internal fields like builtIn or category to prevent unauthorized configuration changes.
  • [SAFE]: Dependencies on external skills (like nocobase-ai-manager) are handled through defined hand-off protocols, ensuring that sensitive operations like LLM service configuration are not handled locally.
  • [SAFE]: Input validation is enforced via a 'Mandatory Clarification Gate', limiting the agent's autonomy and preventing silent mutations or accidental data loss.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 01:59 AM
Security Audit — agent-trust-hub — nocobase-ai-employee