nextjs-ops
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a maintenance script (
scripts/check-nextjs-facts.py) that queries the official NPM registry to verify framework version data. - Evidence: Queries
https://registry.npmjs.orgusingurllib.request.urlopento check for version drift. - Context: This is a well-known service (NPM) and the download is used for data verification, not execution.
- [COMMAND_EXECUTION]: The skill provides a static analysis tool (
scripts/audit-app-router.py) and a test runner (tests/run.sh) to be executed by the agent. - Evidence: The Python script traverses the project filesystem to identify insecure coding patterns using
os.walkandpathlib.Path.read_text. - Scope: The script performs read-only operations for linting purposes and does not execute the scanned content.
- [DYNAMIC_EXECUTION]: The test script
tests/run.shuses one-line Python commands to parse and validate JSON output during self-tests. - Evidence: Usage of
python -c 'import json,sys; ...'within the bash script. - Context: This is a standard and safe method for processing structured data in shell environments and is restricted to the skill's testing lifecycle.
Audit Metadata