next-best-practices
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMMETADATA_POISONINGPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill presents itself as authoritative documentation for Next.js 16.3.3 and references a stable release date of August 25, 2026. Since these versions and dates do not currently exist, the content is deceptive and may lead an AI agent to attempt to use non-existent APIs or frameworks, resulting in invalid code or hallucinations.\n- [PROMPT_INJECTION]: The skill includes instructions directed at the agent regarding the maintenance of 'managed blocks' in files like AGENTS.md and CLAUDE.md. It instructs the agent to follow these blocks and preserve instructions, which is a form of self-modifying prompt injection that attempts to control how the agent manages its own internal configuration and state across sessions.\n- [INDIRECT_PROMPT_INJECTION]: \n
- Ingestion points: The skill instructs the agent to read and follow content from package.json, lockfiles, next.config.*, and repository-level instruction files like AGENTS.md.\n
- Boundary markers: While it mentions 'managed blocks,' it lacks robust boundary markers or explicit instructions to ignore embedded malicious prompts within those ingested files.\n
- Capability inventory: The skill leverages the agent's capabilities for local file system reading, potentially writing (via the 'maintain managed block' instruction), and fetching remote documentation via URLs.\n
- Sanitization: The skill does not provide any instructions or mechanisms for the agent to sanitize or validate the content found within the local repository files or remote URLs before acting upon them.
Audit Metadata