nextjs-developer
Fail
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Automated security scanners (URLite) have flagged the author's documentation domain (
jeffallan.github.io) as malicious. The skill prominently directs users and agents to this site for extended guidance.\n- [COMMAND_EXECUTION]: The main instruction file (SKILL.md) was identified asFileRepMalwareby automated reputation scanners. Furthermore, the skill's reference guide for server actions (references/server-actions.md) demonstrates a file upload pattern usingwriteFilewith an unsanitizedfile.namefrom theFormDataobject. This is a significant security flaw that enables path traversal attacks, allowing a malicious actor to overwrite arbitrary files on the server.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external and user-controlled data via Next.js Server Actions and data fetching utilities. While some examples suggest using Zod for validation, several provided templates lack input sanitization or explicit boundary markers for untrusted data, creating a surface where malicious external content could influence application behavior or data integrity.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata