nextjs-expert
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs environment detection and project diagnosis using standard system utilities and development tools.
- Executes
grepandfindto analyze source code patterns and project structure. - Utilizes
npmandnpxto run build scripts and diagnostic tools like@next/bundle-analyzerandlighthouse. - Uses
curlto verify the accessibility of local API routes onlocalhost:3000. - [INDIRECT_PROMPT_INJECTION]: The skill implements an attack surface by reading and processing local source code files which could contain untrusted data.
- Ingestion points: Files with
.js,.jsx,.ts, and.tsxextensions in theapp/andpages/directories are read usinggrepcommands. - Boundary markers: None identified; the skill does not explicitly instruct the agent to ignore potential instructions embedded within the analyzed code.
- Capability inventory: The skill has the ability to execute shell commands, perform local network requests via
curl, and trigger project build processes. - Sanitization: Content read from files is not sanitized or escaped before being presented to the agent for analysis.
- [DYNAMIC_EXECUTION]: The skill uses inline Node.js execution for environment detection.
- Employs
node -eto programmatically extract the Next.js version from the project'spackage.jsonfile.
Audit Metadata