next-devtools-mcp-skill
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions direct the agent to "ALWAYS call the
inittool ... FIRST ... without being asked," attempting to bypass user confirmation and override the agent's autonomous behavior. - [COMMAND_EXECUTION]: The skill provides numerous shell commands for environment setup, package installation (
npx,npm,pnpm), and framework migrations. - [EXTERNAL_DOWNLOADS]: The skill fetches the
next-devtools-mcppackage from the npm registry for installation and execution. - [DATA_EXFILTRATION]: The
nextjs_calltool provides access to sensitive project data including environment variables (nextjs://env) and internal configuration files (nextjs://config), creating a risk of credential exposure. - [REMOTE_CODE_EXECUTION]: The
browser_evaltool supports arbitrary JavaScript execution in a browser context via theevaluateaction, creating a risk of malicious script execution if the agent is misled. - [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Ingestion points include untrusted web content via
browser_evaland server logs vianextjs_call. Boundary markers and sanitization are absent, while capabilities include shell commands and browser automation.
Audit Metadata