nocobase-portal-manage

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute nb portal commands. It constructs these commands using inputs such as portal names, environment names, and Git repository details. The workflow includes a hard rule to verify command availability before execution.
  • [EXTERNAL_DOWNLOADS]: The skill manages external content by pulling portal source code from Git repositories and installing templates from npm packages or remote URLs. These are standard operations for the described management tasks for the NocoBase platform.
  • [PROMPT_INJECTION]: The skill processes data from the nb portal list -j command to resolve portal targets, which represents an indirect ingestion surface for potentially untrusted metadata.
  • Ingestion points: Structured JSON output from the nb portal list -j command (referenced in SKILL.md and references/runtime-contract.md).
  • Boundary markers: No explicit delimiters are used for the ingested CLI output.
  • Capability inventory: The skill has access to Bash, Write, Grep, and Glob tools.
  • Sanitization: The skill mandates exact string matching for portal names and strictly derives implementation routing from the portalType field to prevent misinterpretation of portal configurations.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 07:30 AM
Security Audit — agent-trust-hub — nocobase-portal-manage