next-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches upgrade guides and documentation from official Next.js domains (nextjs.org).
- [REMOTE_CODE_EXECUTION]: Executes remote scripts using
npx @next/codemod@latest. This is a standard procedure for Next.js upgrades using official tools provided by the framework authors. - [COMMAND_EXECUTION]: Performs shell commands to install packages and run build/development tasks (
npm install,npm run build). These are expected actions for a development utility skill. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local
package.jsonfile to determine versioning. - Ingestion points: Reads
package.jsonin Step 1. - Boundary markers: None specified for file content parsing.
- Capability inventory: Includes shell command execution (
npm,npx) and network fetching. - Sanitization: None specified for version strings parsed from the project file.
Audit Metadata