skills/bastndev/skills/start-nextjs/Gen Agent Trust Hub

start-nextjs

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard development commands including bun create next-app to initialize the project and bun add lucide-react for dependency management. These operations are performed in the project root and are appropriate for a scaffolding tool.
  • [EXTERNAL_DOWNLOADS]: Fetches framework components and the lucide-react icon library from official registries during the setup process. These downloads are expected for the creation of a Next.js application.
  • [INDIRECT_PROMPT_INJECTION]: The skill derives the project name from the current directory name and interpolates it into README.md and src/consts.ts. While this processes user-controlled data, it is a standard feature of project initializers and does not present an exploitable vulnerability in this context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 03:26 AM