nocobase-file-manager
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates exclusively through the NocoBase 'nb' CLI, which provides a structured and authenticated interface for all operations. All external resources, including documentation and API endpoints, trace back to the vendor 'nocobase' infrastructure.
- [SAFE]: Hardcoded credential exposure is prevented by requiring the use of environment variable placeholders (e.g.,
{{env.VARIABLE_NAME}}) for all sensitive storage configuration fields, such as access keys and secrets. - [SAFE]: Information disclosure is mitigated by explicitly excluding sensitive configuration blocks (
optionsandsettings) when listing or retrieving storage engine details through the CLI. - [SAFE]: The skill enforces a rigorous safety gate, requiring fresh secondary confirmation for all high-risk actions including record or storage engine deletion and security setting modifications.
- [SAFE]: File system security for 'local' storage engines is addressed by mandating that document roots reside within trusted directories and explicitly rejecting path traversal attempts.
Audit Metadata