The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation and scripts contain example credentials (admin@nocobase.com / admin123) intended for use with local development instances. The skill provides secure methods for users to supply their own credentials via environment variables or established AI agent configuration paths (e.g., .claude/settings.json).\n- [COMMAND_EXECUTION]: The skill uses sub-processes to execute git for DSL versioning and psql for database-level trigger and function management. It employs identifier sanitization (e.g., regex-based character filtering for SQL object names) to protect against command injection vectors.\n- [DYNAMIC_EXECUTION]: The tool reads JavaScript and SQL files from the local project directory and deploys them to the NocoBase platform for server-side execution. It includes a dedicated security check in js-filler.ts that monitors for forbidden APIs in the JavaScript code (such as eval or fetch) to maintain the integrity of the target environment's sandbox.\n- [INDIRECT_PROMPT_INJECTION]: By processing DSL configurations from external YAML files, the skill has a surface for indirect prompt injection. This is mitigated through the use of structured data formats (JSON/YAML), localized file path resolution that prevents path traversal, and a rigorous pre-deployment validation engine.

nocobase-dsl-reconciler