nextjs-application-performance

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell commands to perform build memory profiling and smoke testing of the standalone server.
  • Evidence: scripts/run-build-memory-probe.mjs uses node:child_process spawn to execute user-provided build commands.
  • Evidence: scripts/smoke-next-standalone.mjs uses spawn to start the Next.js standalone server for runtime verification.
  • [REMOTE_CODE_EXECUTION]: The audit script dynamically evaluates the project's local Next.js configuration file.
  • Evidence: scripts/audit-next-build-contract.mjs uses the dynamic import() statement to load and evaluate the project's next.config.mjs to inspect webpack externals and other build-time settings.
  • [PROMPT_INJECTION]: The skill implements a project-specific instruction resolver that ingests external configuration data.
  • Ingestion points: .agents/skills-config/nextjs-application-performance/config.yaml and project-defined markdown profile files are read by scripts/resolve.py.
  • Boundary markers: The resolver script wraps ingested content within explicit markdown headers like ## Project Instructions and ## Generic Instructions.
  • Capability inventory: The skill can execute shell commands (scripts/run-build-memory-probe.mjs, scripts/smoke-next-standalone.mjs) and perform dynamic code loading (scripts/audit-next-build-contract.mjs).
  • Sanitization: scripts/resolve.py performs path containment checks using Path.resolve() to ensure configuration paths do not escape the repository root.
  • [DYNAMIC_EXECUTION]: The skill generates JavaScript code for browser-side geometry probing.
  • Evidence: scripts/overlay-geometry-probe.mjs stringifies a local function to create a self-contained browser-page expression for geometry and portal audits.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 06:07 AM
Security Audit — agent-trust-hub — nextjs-application-performance