nextjs-data-access-layer
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill instructions follow security best practices for Next.js development, including the use of 'server-only' markers to prevent accidental client-side execution, mandatory authorization co-location within Data Access Layer (DAL) functions, and Data Transfer Object (DTO) transformation to prevent ORM model leakage.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided architectural queries and code structures. It manages this ingestion surface by providing defensive coding guidelines that promote the use of experimental Taint APIs to secure sensitive data references.
- Ingestion points: User architectural queries regarding Server/Client component interactions (defined in
evals/evals.json). - Boundary markers: None explicitly defined in the prompt instructions to delimit user-provided code snippets.
- Capability inventory: The skill YAML frontmatter does not request access to any agent tools or external system execution capabilities.
- Sanitization: The skill explicitly recommends using
taintObjectReferenceandtaintUniqueValueto sanitize and protect sensitive data objects from reaching the frontend context.
Audit Metadata