next-best-practices

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes several npx commands for official Next.js migration codemods (@next/codemod) and deployment tools (create-sst, @opennextjs/aws). These are standard industry tools for the framework's ecosystem.
  • [REMOTE_CODE_EXECUTION]: The debug-tricks.md file documents the Next.js Model Context Protocol (MCP) endpoint (/_next/mcp), which is a legitimate feature for AI-assisted debugging in local development environments. The provided curl examples target localhost and are used to interact with the local development server.
  • [DATA_EXPOSURE]: The skill uses appropriate placeholders like YOUR_API_KEY and references environment variables (REDIS_URL, DATABASE_URL) in its examples, following security best practices by avoiding hardcoded credentials.
  • [DYNAMIC_EXECUTION]: The scripts.md file demonstrates the use of dangerouslySetInnerHTML within the Next.js Script component. This is presented in a specific, documented context for providing an id to inline scripts, which is a standard requirement in the framework.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 05:57 AM