nocobase-ai-employee
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strict 'Safety Gates' requiring explicit human confirmation for high-impact actions like deleting custom employees or changing identity settings.
- [SAFE]: It enforces a 'Non-Developer' restriction, preventing the exposure of internal system employees (e.g., nathan, dara) to business users, which mitigates privilege escalation risks.
- [SAFE]: The skill uses a 'Safe-Field Contract' that explicitly lists allowed writable fields and mandates the rejection of protected internal fields like
builtInorcategoryto prevent unauthorized configuration changes. - [SAFE]: Dependencies on external skills (like
nocobase-ai-manager) are handled through defined hand-off protocols, ensuring that sensitive operations like LLM service configuration are not handled locally. - [SAFE]: Input validation is enforced via a 'Mandatory Clarification Gate', limiting the agent's autonomy and preventing silent mutations or accidental data loss.
Audit Metadata