nextjs-16
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends executing code from an unverified NPM package (next-devtools-mcp) using 'npx -y ...@latest' in references/devtools-mcp.md. This poses a risk as the package source is not a trusted organization or well-known service.- [METADATA_POISONING]: The skill is titled 'Next.js 16' and describes breaking changes such as proxy.ts replacing middleware.ts that do not exist in current official Next.js releases. This could lead to developer confusion or implementation of non-standard, potentially unsafe patterns.- [INDIRECT_PROMPT_INJECTION]:\n
- Ingestion points: The mandatory Agent Workflow in SKILL.md instructs the agent to query external documentation via Context7/Exa. Reference files like analytics.md and third-party.md also suggest loading external scripts.\n
- Boundary markers: None identified.\n
- Capability inventory: The skill documentation includes commands for package installation (bun, npm, npx), file creation, and network requests (fetch, sendBeacon).\n
- Sanitization: No evidence of input validation or sanitization for external content is present.- [PROMPT_INJECTION]: The SKILL.md file contains a MANDATORY workflow section that dictates specific agent sub-tasking and parallel execution, which attempts to override the agent's autonomous planning and reasoning.- [EXTERNAL_DOWNLOADS]: The skill references multiple third-party packages and services, including Vercel Analytics, Sentry, and Google Analytics. While most are well-known, others like next-devtools-mcp are from unverified sources.
Audit Metadata