nextjs-application-performance
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands to perform build memory profiling and smoke testing of the standalone server.
- Evidence:
scripts/run-build-memory-probe.mjsusesnode:child_processspawnto execute user-provided build commands. - Evidence:
scripts/smoke-next-standalone.mjsusesspawnto start the Next.js standalone server for runtime verification. - [REMOTE_CODE_EXECUTION]: The audit script dynamically evaluates the project's local Next.js configuration file.
- Evidence:
scripts/audit-next-build-contract.mjsuses the dynamicimport()statement to load and evaluate the project'snext.config.mjsto inspect webpack externals and other build-time settings. - [PROMPT_INJECTION]: The skill implements a project-specific instruction resolver that ingests external configuration data.
- Ingestion points:
.agents/skills-config/nextjs-application-performance/config.yamland project-defined markdown profile files are read byscripts/resolve.py. - Boundary markers: The resolver script wraps ingested content within explicit markdown headers like
## Project Instructionsand## Generic Instructions. - Capability inventory: The skill can execute shell commands (
scripts/run-build-memory-probe.mjs,scripts/smoke-next-standalone.mjs) and perform dynamic code loading (scripts/audit-next-build-contract.mjs). - Sanitization:
scripts/resolve.pyperforms path containment checks usingPath.resolve()to ensure configuration paths do not escape the repository root. - [DYNAMIC_EXECUTION]: The skill generates JavaScript code for browser-side geometry probing.
- Evidence:
scripts/overlay-geometry-probe.mjsstringifies a local function to create a self-contained browser-page expression for geometry and portal audits.
Audit Metadata