next-best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several
npxcommands for official Next.js migration codemods (@next/codemod) and deployment tools (create-sst,@opennextjs/aws). These are standard industry tools for the framework's ecosystem. - [REMOTE_CODE_EXECUTION]: The
debug-tricks.mdfile documents the Next.js Model Context Protocol (MCP) endpoint (/_next/mcp), which is a legitimate feature for AI-assisted debugging in local development environments. The providedcurlexamples targetlocalhostand are used to interact with the local development server. - [DATA_EXPOSURE]: The skill uses appropriate placeholders like
YOUR_API_KEYand references environment variables (REDIS_URL,DATABASE_URL) in its examples, following security best practices by avoiding hardcoded credentials. - [DYNAMIC_EXECUTION]: The
scripts.mdfile demonstrates the use ofdangerouslySetInnerHTMLwithin the Next.jsScriptcomponent. This is presented in a specific, documented context for providing anidto inline scripts, which is a standard requirement in the framework.
Audit Metadata