NocoDB Skiils
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This appears to be a straightforward NocoDB API CLI, but it uses your NocoDB token and can change or delete database and workspace data.
Use this skill only with a trusted NocoDB URL and a least-privilege API token. Review destructive actions, bulk updates, membership changes, schema changes, and file uploads before allowing the agent to run them.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings for this skill version.
- Malicious
- 0
- Suspicious
- 0
- Harmless
- 0
- Undetected
- 63
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the agent runs the wrong command or uses the wrong base/table/record, NocoDB data or structure could be changed or deleted.
The skill explicitly exposes destructive and bulk-mutating NocoDB operations. This matches the stated database-management purpose, but these commands can materially alter or delete user/team data.
nc workspace:delete wabc1234xyz ... nc base:delete pdef5678uvw ... nc table:delete pdef5678uvw mghi9012rst ... nc record:update-many ... nc record:delete pdef5678uvw mghi9012rst '[31,32]'
Keep human review or confirmation around delete, bulk update, member-management, and schema-changing commands.
Anyone or any agent action using this skill can act with the permissions of the configured NocoDB token.
The script uses the user's NocoDB API token as delegated authority for API calls. This is expected for the integration, but the token may grant broad account or workspace privileges.
NC_TOKEN="${NOCODB_TOKEN:-}" ... _get() { curl -sS -H "xc-token: $NC_TOKEN" "$NC_URL/api/v3/$1"; }Use a token limited to the intended workspace/base where possible, rotate it if exposed, and avoid setting NOCODB_URL to an untrusted endpoint.
A local file chosen for an attachment command will be sent to the configured NocoDB server.
The helper can upload a user-selected local file to the configured NocoDB API endpoint. This is consistent with attachment support, but local file uploads should be scoped carefully.
_upload() { curl -sS -X POST -H "xc-token: $NC_TOKEN" -F "file=@$2" "$NC_URL/api/v3/$1"; }Only allow uploads of files the user explicitly selected, and avoid broad or sensitive local paths.
It may be harder to verify that this package is the intended NocoDB skill and to audit updates over time.
The registry metadata does not provide a clear source or homepage for provenance. The visible script is coherent, but users have less context for publisher verification.
Source: unknown; Homepage: none
Install only if you trust the registry entry or can verify the publisher/source through an independent channel.