nextjs-app-router
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation and code examples for Next.js 16 App Router features. All patterns follow established security best practices, such as server-side validation and secure environment variable management.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies external data fetching as a risk surface when using
fetch()in Server Components. It addresses this by providing an evidence-based mitigation strategy including: - Ingestion points:
fetch()calls in Server Components and API Route Handlers. - Boundary markers: Explicit instructions to validate third-party responses.
- Capability inventory: Data fetching, database access, and project initialization tools.
- Sanitization: Demonstrating the use of Zod for schema validation and DOMPurify for sanitizing user-generated content.
- [EXTERNAL_DOWNLOADS]: The skill references standard project initialization via
npx create-next-app@latestand the use of well-known libraries such aszod,@upstash/ratelimit, andisomorphic-dompurify. These are standard, trusted packages within the JavaScript ecosystem.
Audit Metadata