nextjs-quality

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run standard development commands such as next build, eslint, and next experimental-analyze to verify project quality and measure bundles. These are expected operations for a development-focused skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and audit project source code and configuration files. While this creates a theoretical surface for indirect prompt injection, it is the primary and intended purpose of the skill. The instructions focus on static analysis and standard build processes.
  • Ingestion points: Project configuration (next.config.ts), linting setup (eslint.config.mjs), and application modules (SKILL.md workflow steps 1, 2, and 4).
  • Boundary markers: None identified in the instructional flow for data ingestion.
  • Capability inventory: Execution of build and linting tools via shell subprocesses.
  • Sanitization: None specified, relying on standard CLI tool behavior.
  • [EXTERNAL_DOWNLOADS]: The playbook recommends installing official Next.js ecosystem packages (eslint-config-next, @next/bundle-analyzer) and running official codemods from Vercel's @next/codemod registry. These are well-known and trusted sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 05:22 PM