next-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches documentation and migration guidelines from the official Next.js website (
nextjs.org), which is a well-known service managed by Vercel. - [COMMAND_EXECUTION]: Instructs the agent to execute standard developer commands to manage dependencies and run migration scripts.
- Specific commands include
npm installfor updatingnext,react, andreact-dompackages. - Uses
npx @next/codemod@latestto execute official transformation scripts provided by the framework vendor. - [INDIRECT_PROMPT_INJECTION]: The skill processes external information by fetching documentation from
nextjs.orgusing the WebFetch tool. - Ingestion points: Official Next.js upgrade guides and codemod documentation in markdown/HTML format.
- Boundary markers: No explicit delimiters are specified to isolate fetched instructions from the agent's core instructions.
- Capability inventory: The agent has the capability to execute shell commands (
npm,npx) and perform file system modifications (updates topackage.jsonand code transforms). - Sanitization: The skill relies on the trustworthiness of the official documentation source; no additional sanitization of the fetched content is described.
Audit Metadata