nextjs-ops

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes a maintenance script (scripts/check-nextjs-facts.py) that queries the official NPM registry to verify framework version data.
  • Evidence: Queries https://registry.npmjs.org using urllib.request.urlopen to check for version drift.
  • Context: This is a well-known service (NPM) and the download is used for data verification, not execution.
  • [COMMAND_EXECUTION]: The skill provides a static analysis tool (scripts/audit-app-router.py) and a test runner (tests/run.sh) to be executed by the agent.
  • Evidence: The Python script traverses the project filesystem to identify insecure coding patterns using os.walk and pathlib.Path.read_text.
  • Scope: The script performs read-only operations for linting purposes and does not execute the scanned content.
  • [DYNAMIC_EXECUTION]: The test script tests/run.sh uses one-line Python commands to parse and validate JSON output during self-tests.
  • Evidence: Usage of python -c 'import json,sys; ...' within the bash script.
  • Context: This is a standard and safe method for processing structured data in shell environments and is restricted to the skill's testing lifecycle.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 04:08 PM