nextjs-server-actions
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages the attack surface associated with processing untrusted data from web forms.
- Ingestion points: Untrusted user input enters the agent's context through
FormDataobjects in Server Actions, specifically inapp/**/actions.tsand related files. - Boundary markers: The skill relies on structured schema validation and standard Next.js programming patterns rather than explicit text delimiters for raw input.
- Capability inventory: The skill enables database mutations (e.g.,
db.post.create) and cache management operations (revalidatePath,revalidateTag). - Sanitization: The skill effectively mitigates injection risks by mandating strict server-side validation using
zodschemas and requiring authorization checks (auth()) within every mutation action.
Audit Metadata