The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves fetching and parsing external prototype files (HTML or links). Phase 0 of the workflow explicitly instructs the agent to search for an embedded <script type="application/nb-spec+json"> and treat it as an 'authoritative spec' for the data model, region mapping, and JavaScript kernels. This creates a vulnerability where a malicious prototype could override agent behavior or inject malicious logic into the generated application.
Ingestion points: SKILL.md (Phase 0) and references/handoff.md specify fetching external prototype URLs via curl and parsing their content.
Boundary markers: There are no explicit instructions to use delimiters or ignore natural language instructions embedded within the untrusted JSON spec.
Capability inventory: The skill possesses capabilities to execute shell commands (via sibling skills) and write JavaScript code to the target NocoBase environment using flowModels:save.
Sanitization: The instructions do not specify any validation or filtering of the external JSON spec before adoption.
[DYNAMIC_EXECUTION]: The skill is centered around the dynamic generation and deployment of JavaScript snippets ('kernels') to the NocoBase platform. Several templates in the references/template-library/ (e.g., conditionCards.md, conditionMenu.md, heroBanner.md) use the new Function() constructor to evaluate logic defined in parameters. While this is a core feature of the target platform's 'RunJS' system, the risk is elevated because the inputs for this code generation can originate from the untrusted 'authoritative spec' found in external prototypes.
[CREDENTIALS_UNSAFE]: The references/visual-loop.md and references/gotchas.md files instruct the user or agent to inject a sensitive NOCOBASE_TOKEN into the browser's localStorage to facilitate automated verification with Playwright. While documented as a necessary step for the development workflow, it involves handling sensitive authentication tokens.

nocobase-prototype-repro