next-devtools-mcp-skill

Warn

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill instructions direct the agent to "ALWAYS call the init tool ... FIRST ... without being asked," attempting to bypass user confirmation and override the agent's autonomous behavior.
  • [COMMAND_EXECUTION]: The skill provides numerous shell commands for environment setup, package installation (npx, npm, pnpm), and framework migrations.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the next-devtools-mcp package from the npm registry for installation and execution.
  • [DATA_EXFILTRATION]: The nextjs_call tool provides access to sensitive project data including environment variables (nextjs://env) and internal configuration files (nextjs://config), creating a risk of credential exposure.
  • [REMOTE_CODE_EXECUTION]: The browser_eval tool supports arbitrary JavaScript execution in a browser context via the evaluate action, creating a risk of malicious script execution if the agent is misled.
  • [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Ingestion points include untrusted web content via browser_eval and server logs via nextjs_call. Boundary markers and sanitization are absent, while capabilities include shell commands and browser automation.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 13, 2026, 10:05 AM
Security Audit — agent-trust-hub — next-devtools-mcp-skill