The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the environment and Git repositories which could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: The agent reads structured output from nb portal list -j and nb portal info -j, Git error messages, portal.config.json files, and template source code (referenced in SKILL.md and references/runtime-contract.md).
Boundary markers: While the skill uses structured JSON parsing and specific CLI flags, it lacks explicit prompt boundary markers or "ignore embedded instructions" warnings when processing content from these external sources.
Capability inventory: The skill utilizes the Bash tool to execute system commands, the Write tool for local file modifications, and can invoke the nocobase-ai-builder skill to execute source code changes (documented in SKILL.md).
Sanitization: The logic mandates exact string matching for Portal names and strictly relies on the portalType field from CLI records to determine execution paths, reducing the risk of schema confusion or ambiguous target selection.
[COMMAND_EXECUTION]: The skill uses the Bash tool to interact with the nb CLI for portal lifecycle management, including environment inspection and API calls. This is the primary function of the skill and follows the documented runtime contract for the NocoBase platform.
[EXTERNAL_DOWNLOADS]: The skill performs remote operations such as nb portal pull to download source code from Git repositories and nb portal push to sync changes. These operations target vendor-specified infrastructure and Git remotes provided by the user, representing standard development workflows.

nocobase-portal-manage