nocobase-ai-knowledge-base-manager

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the nb CLI tool to perform administrative operations, including plugin management and knowledge base configuration. These commands are restricted to the vendor's own ecosystem and are gated by mandatory capability checks.
  • [EXTERNAL_DOWNLOADS]: The skill references official NocoBase documentation and manages vendor-specific Node.js packages (@nocobase/plugin-ai-knowledge-base, @nocobase/plugin-ai). These are identified as legitimate vendor resources.
  • [CREDENTIALS_UNSAFE]: While the skill manages sensitive connection details like PGVECTOR_PASSWORD, it implements robust protection mechanisms. Instructions explicitly mandate the use of mode-600 protected files and the suppression of secrets from all logs, summaries, and safe-field readbacks.
  • [DATA_EXFILTRATION]: No unauthorized network operations or data transmission to untrusted domains were detected. Network activity is limited to authorized CLI operations within the NocoBase environment.
  • [SAFE]: The skill incorporates extensive security guardrails, such as mandatory disclosure of edition requirements, verification of plugin states before execution, and the use of 'safe-field readback' to ensure no sensitive data is exposed during configuration audits.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 07:30 AM
Security Audit — agent-trust-hub — nocobase-ai-knowledge-base-manager