start-nextjs
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard development commands including
bun create next-appto initialize the project andbun add lucide-reactfor dependency management. These operations are performed in the project root and are appropriate for a scaffolding tool. - [EXTERNAL_DOWNLOADS]: Fetches framework components and the
lucide-reacticon library from official registries during the setup process. These downloads are expected for the creation of a Next.js application. - [INDIRECT_PROMPT_INJECTION]: The skill derives the project name from the current directory name and interpolates it into
README.mdandsrc/consts.ts. While this processes user-controlled data, it is a standard feature of project initializers and does not present an exploitable vulnerability in this context.
Audit Metadata