nextjs-app-router
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external input through Next.js Route Handlers, creating a potential surface for indirect prompt injection if the processed data is later used in an LLM context.
- Ingestion points: API routes in app/api/incidents/route.ts ingest untrusted data from request.nextUrl.searchParams.
- Boundary markers: The code demonstrates the use of zod schema validation (QuerySchema.safeParse) to delimit and validate input.
- Capability inventory: The skill includes database query capabilities (db.query.incidents.findMany) using the processed data.
- Sanitization: Input is validated against a structured schema before being used in application logic.
Audit Metadata