registry / @nocobase/skills / 2.0.23

@nocobase/skills@2.0.23

> [!WARNING] > NocoBase Skills is still in draft status. The content is for reference and may change at any time.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 264 file(s), 1.79 MB of source

Source & flagged code

4 flagged

skills/nocobase-dsl-reconciler/src/deploy/fillers/sub-table.tsView file

Lines 8-48typescript

8 * user expects.

9 *

10 * Why a separate post-compose pass:

11 * - The compose API doesn't currently let us pick a field model by

12 * class name, so we let it create the default RecordSelect, then

13 * mutate via flowModels:save (idempotent upsert by uid).

14 * - The column choice + per-column field interface needs collection

15 * metadata that compose doesn't see at our layer.

16 */

17import type { BlockSpec, FieldRef, SubTableColumn } from '../../types/spec';

18import type { DeployContext } from './types';

19import { generateUid } from '../../utils/uid';

21/** Map collection field interface → input FieldModel class for sub-table cells. */

22const INPUT_FIELD_MODEL_MAP: Record<string, string> = {

23 input: 'InputFieldModel',

24 textarea: 'InputFieldModel',

25 email: 'InputFieldModel',

26 phone: 'InputFieldModel',

27 url: 'InputFieldModel',

28 password: 'InputFieldModel',

Medium

Secret Pattern

Package contains a possible secret pattern.

skills/nocobase-dsl-reconciler/src/deploy/fillers/sub-table.tsView on unpkg · L28

29 integer: 'NumberFieldModel',

30 number: 'NumberFieldModel',

31 percent: 'NumberFieldModel',

32 select: 'SelectFieldModel',

33 radioGroup: 'SelectFieldModel',

34 multipleSelect: 'SelectFieldModel',

35 checkboxGroup: 'SelectFieldModel',

36 checkbox: 'CheckboxFieldModel',

37 date: 'DatePickerFieldModel',

38 datetime: 'DatePickerFieldModel',

39 time: 'TimePickerFieldModel',

40 color: 'ColorPickerFieldModel',

41 m2o: 'RecordSelectFieldModel',

42 o2o: 'RecordSelectFieldModel',

43 m2m: 'RecordSelectFieldModel',

44 attachment: 'AttachmentFieldModel',

45 json: 'JSONFieldModel',

46 richText: 'RichTextFieldModel',

47};

skills/nocobase-dsl-reconciler/src/deploy/spec-validator.tsView file

Lines 564-604typescript

564 }

565 }

566

567 // ── Rule: filterForm recommends <= 3 fields ──

568 // Was an error — downgraded to warn. 4-5 filters (amount range + status

569 // + date + owner) is common and valid UX; only flag as a layout hint.

570 const filterFields = (bs.fields || []).filter(f =>

skills/nocobase-dsl-reconciler/scripts/e2e.shView file

•path = skills/nocobase-dsl-reconciler/scripts/e2e.sh kind = build_helper sizeBytes = 11580 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/nocobase-dsl-reconciler/scripts/e2e.shView on unpkg

skills/nocobase-plugin-development/references/server/test.mdView file

Lines 90-130markdown

90 .post('/todos:update/1')

91 .send({ completed: true });

93 expect(res.status).toBe(200);

94 });

96 it('should delete a record', async () => {

97 const res = await app.agent().post('/todos:destroy/1');

98 expect(res.status).toBe(200);

99 });

100});

101```

Source & flagged code

4 flagged · loading source

skills/nocobase-dsl-reconciler/src/deploy/fillers/sub-table.tsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...el',

Medium

Secret Pattern

Package contains a possible secret pattern.

skills/nocobase-dsl-reconciler/src/deploy/fillers/sub-table.tsView on unpkg · L28

skills/nocobase-dsl-reconciler/src/deploy/spec-validator.tsView file

584try { L585: const fs = require('fs'); L586: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

skills/nocobase-dsl-reconciler/src/deploy/spec-validator.tsView on unpkg · L584

skills/nocobase-dsl-reconciler/scripts/e2e.shView file

•path = skills/nocobase-dsl-reconciler/scripts/e2e.sh kind = build_helper sizeBytes = 11580 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/nocobase-dsl-reconciler/scripts/e2e.shView on unpkg

skills/nocobase-plugin-development/references/server/test.mdView file

110patternName = generic_password severity = medium line = 110 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in skills/nocobase-plugin-development/references/server/test.md

skills/nocobase-plugin-development/references/server/test.mdView on unpkg · L110

Findings

7 Medium3 Low

MediumSecret Patternskills/nocobase-dsl-reconciler/src/deploy/fillers/sub-table.ts

MediumDynamic Requireskills/nocobase-dsl-reconciler/src/deploy/spec-validator.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/nocobase-dsl-reconciler/scripts/e2e.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/nocobase-plugin-development/references/server/test.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

skills/nocobase-dsl-reconciler/src/deploy/fillers/sub-table.tsView file

Lines 8-48typescript

8 * user expects.

9 *

10 * Why a separate post-compose pass:

11 * - The compose API doesn't currently let us pick a field model by

12 * class name, so we let it create the default RecordSelect, then

13 * mutate via flowModels:save (idempotent upsert by uid).

14 * - The column choice + per-column field interface needs collection

15 * metadata that compose doesn't see at our layer.

16 */

17import type { BlockSpec, FieldRef, SubTableColumn } from '../../types/spec';

18import type { DeployContext } from './types';

19import { generateUid } from '../../utils/uid';

21/** Map collection field interface → input FieldModel class for sub-table cells. */

22const INPUT_FIELD_MODEL_MAP: Record<string, string> = {

23 input: 'InputFieldModel',

24 textarea: 'InputFieldModel',

25 email: 'InputFieldModel',

26 phone: 'InputFieldModel',

27 url: 'InputFieldModel',

28 password: 'InputFieldModel',

Medium

Secret Pattern

Package contains a possible secret pattern.

skills/nocobase-dsl-reconciler/src/deploy/fillers/sub-table.tsView on unpkg · L28

29 integer: 'NumberFieldModel',

30 number: 'NumberFieldModel',

31 percent: 'NumberFieldModel',

32 select: 'SelectFieldModel',

33 radioGroup: 'SelectFieldModel',

34 multipleSelect: 'SelectFieldModel',

35 checkboxGroup: 'SelectFieldModel',

36 checkbox: 'CheckboxFieldModel',

37 date: 'DatePickerFieldModel',

38 datetime: 'DatePickerFieldModel',

39 time: 'TimePickerFieldModel',

40 color: 'ColorPickerFieldModel',

41 m2o: 'RecordSelectFieldModel',

42 o2o: 'RecordSelectFieldModel',

43 m2m: 'RecordSelectFieldModel',

44 attachment: 'AttachmentFieldModel',

45 json: 'JSONFieldModel',

46 richText: 'RichTextFieldModel',

47};

skills/nocobase-dsl-reconciler/src/deploy/spec-validator.tsView file

Lines 564-604typescript

564 }

565 }

566

567 // ── Rule: filterForm recommends <= 3 fields ──

568 // Was an error — downgraded to warn. 4-5 filters (amount range + status

569 // + date + owner) is common and valid UX; only flag as a layout hint.

570 const filterFields = (bs.fields || []).filter(f =>

skills/nocobase-dsl-reconciler/scripts/e2e.shView file

•path = skills/nocobase-dsl-reconciler/scripts/e2e.sh kind = build_helper sizeBytes = 11580 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/nocobase-dsl-reconciler/scripts/e2e.shView on unpkg

skills/nocobase-plugin-development/references/server/test.mdView file

Lines 90-130markdown

90 .post('/todos:update/1')

91 .send({ completed: true });

93 expect(res.status).toBe(200);

94 });

96 it('should delete a record', async () => {

97 const res = await app.agent().post('/todos:destroy/1');

98 expect(res.status).toBe(200);

99 });

100});

101```