nocobase-plugin-development
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands including
nb,yarn, andgitto manage the plugin lifecycle (scaffolding, building, and enabling). These operations are standard for a development environment and are protected by mandatory 'Plan Confirmation' and 'Safety Gate' steps requiring explicit user approval before execution. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to generate code based on natural language requirements provided by the user. While this creates a potential surface for indirect injection, the skill mitigates this risk through a mandatory clarification process and a requirement that the agent present a functional plan for user review before any code is generated or files are modified.
- [EXTERNAL_DOWNLOADS]: The skill instructions include cloning the NocoBase source repository from the official GitHub repository (
https://github.com/nocobase/nocobase.git) when a local source tree is missing. This reference targets the vendor's official repository.
Audit Metadata