start-nextjs
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes standard framework and UI scaffolding tools, including
bun create next-appandshadcn init, to generate the project structure.\n- [EXTERNAL_DOWNLOADS]: Fetches official dependencies likelucide-reactandnext-themesfrom the public npm registry.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests the directory basename as the project name and interpolates it into source files. It mitigates potential injection risks by instructing the agent to safely escape the value as a TypeScript string. This finding is documented due to the ingestion of external data, but the implementation follows safe practices.
Audit Metadata