nextjs-quality
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run standard development commands such as
next build,eslint, andnext experimental-analyzeto verify project quality and measure bundles. These are expected operations for a development-focused skill. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and audit project source code and configuration files. While this creates a theoretical surface for indirect prompt injection, it is the primary and intended purpose of the skill. The instructions focus on static analysis and standard build processes.
- Ingestion points: Project configuration (
next.config.ts), linting setup (eslint.config.mjs), and application modules (SKILL.mdworkflow steps 1, 2, and 4). - Boundary markers: None identified in the instructional flow for data ingestion.
- Capability inventory: Execution of build and linting tools via shell subprocesses.
- Sanitization: None specified, relying on standard CLI tool behavior.
- [EXTERNAL_DOWNLOADS]: The playbook recommends installing official Next.js ecosystem packages (
eslint-config-next,@next/bundle-analyzer) and running official codemods from Vercel's@next/codemodregistry. These are well-known and trusted sources.
Audit Metadata