dot-sdk-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEDATA_EXFILTRATIONPRIVILEGE_ESCALATION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill recommends setting the environment variable
NODE_TLS_REJECT_UNAUTHORIZED=0in the.env.localfile. This setting disables SSL/TLS certificate verification in Node.js, which is a security bypass that makes the application and the agent's execution environment vulnerable to Man-in-the-Middle (MitM) attacks. - [DATA_EXFILTRATION]: The instructions suggest using the
NEXT_PUBLIC_prefix for sensitive variables likeNEXT_PUBLIC_DOTCMS_AUTH_TOKEN. In Next.js, this prefix causes the variable to be bundled and sent to the browser, exposing secret authentication tokens to the client-side where they can be accessed by end-users or malicious scripts.
Audit Metadata