nocobase-publish-manage
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill issues shell commands through the
nb apicommand group to manage database state. This includes creating backups, downloading them to a release workspace, and restoring them to target environments using the--forceflag.- [DYNAMIC_EXECUTION]: Executable shell commands are dynamically generated using context variables such as<backupName>,<ruleId>, and<localFile>derived from user input or previous command responses.- [INDIRECT_PROMPT_INJECTION]: The skill ingests and parses JSON data from thenbCLI tool's output to determine the state of migrations and backups. - Ingestion points: CLI output from
nb api backup list,backup status,migration get, andmigration rules listas defined inreferences/v1-runtime-contract.md. - Boundary markers: The skill requires manual confirmation strings ('confirm input' and 'confirm') before proceeding with package creation or data restoration, as described in
SKILL.md. - Capability inventory: Includes file system writing (downloads), file reading (uploads), and database modification (restore/execute) across multiple environments.
- Sanitization: Utilizes structured
--json-outputflags to facilitate reliable parsing of external data and minimize misinterpretation.
Audit Metadata