nextjs-architect
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines a set of instructions for the agent to perform a static audit of local project files. It identifies security risks such as hardcoded secrets (e.g., NEXT_PUBLIC_*) and missing authorization in Server Actions or API routes. This behavior is consistent with its stated purpose as a developer tool.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it reads untrusted project source code. However, the instructions are structured to treat the code as data to be audited rather than instructions to follow.
- Ingestion points: All files within the scanned project directory (e.g., src/app/, middleware.ts).
- Boundary markers: Absent; the skill does not define specific delimiters for project content.
- Capability inventory: File system read access and the ability to copy a DESIGN.md file. No network or arbitrary command execution capabilities are requested.
- Sanitization: Absent; the skill relies on the agent's interpretation of the code. This surface is considered low risk due to the structured audit context.
Audit Metadata