Nocodb

• Analyzed: May 11, 2026, 7:22 AM
• Findings: 1
• Version: 1.0.4
• Hash: b2febffa9b07c13d5dc103800aeface84ceea7712fd20b647a378e1685448812
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill requires the agent to install a global npm package (`@membranehq/cli`) and execute shell commands to manage authentication and interact with the Nocodb API via the Membrane platform. While these behaviors are clearly aligned with the stated purpose in `SKILL.md` and include security-positive instructions (e.g., avoiding manual handling of API keys), the reliance on shell execution and network access for credential management constitutes a high-risk capability according to the defined threshold. No evidence of intentional malice, such as data exfiltration or unauthorized persistence, was found in `SKILL.md` or `_meta.json`.