next-theme-dev
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill does not contain any detected malicious patterns, obfuscation, or unauthorized exfiltration logic. It adheres to best practices for secure agent tool usage and credential management.
- [COMMAND_EXECUTION]: The skill uses the
ntk(NEXT Theme Kit) CLI and standard development tools (Make, Tailwind, Node.js, Python) to manage theme files. All command execution is scoped to the theme directory, clearly documented, and requires explicit user confirmation through a 'Live Theme Mutation Approval Gate' before any changes are pushed to the remote store. - [EXTERNAL_DOWNLOADS]: The skill downloads starter templates and build tool binaries from official vendor repositories (NextCommerceCo) and trusted third-party services (Tailwind Labs). These downloads are restricted to reputable sources necessary for the theme development workflow.
- [CREDENTIALS_UNSAFE]: The skill provides thorough documentation on managing theme API keys, emphasizing the use of environment variables (
NTK_APIKEY) and advising against storing sensitive keys in plain text within configuration files. It also reminds the user to verify that configuration files are included in.gitignore. - [INDIRECT_PROMPT_INJECTION]: The skill processes external configuration and design data (handoff packages). It proactively mitigates injection risks by requiring the use of a strict validation gate (
validate-package) and deterministic checking scripts (validate-theme-assets.py,assert-geometry.mjs) to ensure that external data is valid and conforms to expected schemas before it is processed.
Audit Metadata