nextjs-expert

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs environment detection and project diagnosis using standard system utilities and development tools.
  • Executes grep and find to analyze source code patterns and project structure.
  • Utilizes npm and npx to run build scripts and diagnostic tools like @next/bundle-analyzer and lighthouse.
  • Uses curl to verify the accessibility of local API routes on localhost:3000.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements an attack surface by reading and processing local source code files which could contain untrusted data.
  • Ingestion points: Files with .js, .jsx, .ts, and .tsx extensions in the app/ and pages/ directories are read using grep commands.
  • Boundary markers: None identified; the skill does not explicitly instruct the agent to ignore potential instructions embedded within the analyzed code.
  • Capability inventory: The skill has the ability to execute shell commands, perform local network requests via curl, and trigger project build processes.
  • Sanitization: Content read from files is not sanitized or escaped before being presented to the agent for analysis.
  • [DYNAMIC_EXECUTION]: The skill uses inline Node.js execution for environment detection.
  • Employs node -e to programmatically extract the Next.js version from the project's package.json file.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 02:36 PM