web-meta-framework-nextjs
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive security guidance for Next.js development, including server-side authorization checks and input validation for public endpoints like Server Actions.- [SAFE]: Includes instructions for protecting sensitive data using the "server-only" package to prevent server-side environment secrets from being accidentally bundled into browser-side code.- [EXTERNAL_DOWNLOADS]: Refers to official migration utilities from Vercel ("npx @next/codemod") for upgrading and transforming project code, which are standard developer tools.- [INDIRECT_PROMPT_INJECTION]: Documents the attack surface presented by user-controlled input in "FormData" and "searchParams", providing mitigation strategies such as schema-based validation and strict boundary enforcement.
- Ingestion points: "FormData" in Server Actions, "params" and "searchParams" in page components and metadata functions.
- Boundary markers: Explicit instructions to validate input and check authorization inside the Server Action body before execution.
- Capability inventory: Database mutations and backend API calls via standard data layer imports.
- Sanitization: Recommends using schema validation libraries to parse and type-check input before it reaches the data layer.
Audit Metadata