The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes a JavaScript node (references/nodes/script.md) which executes code in a Node.js Worker Thread. While isolated by default, the documentation states that providing the WORKFLOW_SCRIPT_MODULES environment variable allows the script to use node:vm and import system modules, granting the script access to the Node.js environment.
[DYNAMIC_EXECUTION]: The sql node (references/nodes/sql.md) allows for the direct execution of parameterized SQL statements against database data sources, which could be exploited for unauthorized data manipulation if inputs are not strictly validated.
[PRIVILEGE_ESCALATION]: The AI Employee node (references/nodes/ai-employee.md) allows the configuration of a userId field, which the AI employee uses to inherit permissions for data access. If this identifier is manipulated, it could lead to the AI performing actions with higher privileges than the triggering user.
[EXTERNAL_DOWNLOADS]: The ai-employee node supports a file_url type within the files array, which instructs the system to download files from arbitrary external URLs and create records in the local aiFiles collection.
[DATA_EXFILTRATION]: The request node (references/nodes/request.md) enables the workflow to make HTTP requests to arbitrary external URLs, providing a vector for exfiltrating workflow context data, database records from query nodes, or results from sql operations.
[INDIRECT_PROMPT_INJECTION]: The AI Employee and LLM nodes ingest untrusted data from the workflow context (such as Webhook payloads or database record changes) and interpolate it directly into AI prompts.
Ingestion points: External data enters via $context.data in webhook, action, and collection triggers, as well as results from request nodes.
Boundary markers: None explicitly defined in the node configurations; relies on the underlying model's internal safety guardrails.
Capability inventory: The skill has access to network operations (request), database writes (create, update, sql), and arbitrary code execution (script).
Sanitization: No explicit sanitization or escaping is documented for variables interpolated into prompt strings.

nocobase-workflow-manage