nextjs
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a legitimate development aid for Next.js, providing documentation and regex-based validation for project configuration and code patterns.
- [SAFE]: Recommended CLI tools and packages, such as Next.js codemods and official utility libraries (@next/third-parties), are standard industry tools from the framework's official ecosystem.
- [SAFE]: Documentation regarding the development-only Model Context Protocol (MCP) endpoint describes a standard feature for AI-assisted local debugging within the Next.js runtime.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local Next.js project source code to provide advice, which is a standard surface for indirect prompt injection if malicious instructions are present in the analyzed files.
- Ingestion points: Project files matching
pathPatterns(e.g.,app/**,next.config.js,tsconfig.json). - Boundary markers: None explicitly defined within the skill's instructions.
- Capability inventory: The skill defines
bashPatternsfor Next.js CLI commands, suggesting the agent may execute shell operations likenext buildornext devbased on detected context. - Sanitization: The skill does not implement specific sanitization or filtering for the code content it processes.
Audit Metadata