nocobase-prototype-repro
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests prototype files from user-supplied URLs and is explicitly instructed to parse an embedded JSON spec as the 'authoritative spec.' It is directed to 'honor its notes/jsKernels' without validation, creating a significant ingestion surface for indirect prompt injection. (Evidence: SKILL.md Phase 0 and Phase 1).
- [REMOTE_CODE_EXECUTION]: Multiple templates in the reference library (e.g., conditionCards.md, kpiStat.md, heroBanner.md) utilize the 'new Function' constructor to execute JavaScript logic. This logic is derived from properties that are populated based on the untrusted external specifications provided in prototypes.
- [COMMAND_EXECUTION]: The skill uses the shell tool to perform administrative tasks, such as creating collections and pages via the NocoBase CLI, and uses curl to fetch external files.
- [EXTERNAL_DOWNLOADS]: Prototype HTML and design files are downloaded from external sources using curl commands.
- [DATA_EXFILTRATION]: The skill's visual convergence loop involves opening the generated application in a Playwright browser with a sensitive NOCOBASE_TOKEN injected into localStorage (visual-loop.md). Because the application content is driven by external specifications, this creates a risk where malicious JavaScript in the spec could exfiltrate the token during the verification process.
Audit Metadata