nextjs-security-audit
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill attempts to install essential security utilities such as jq, the GitHub CLI, and specialized scanners like osv-scanner, gitleaks, and trivy via the Homebrew package manager if they are missing during the preflight phase.
- [DYNAMIC_EXECUTION]: A helper script (
scan.sh) is dynamically generated at runtime to provide optimized grep-based search capabilities for identifying security patterns across the Next.js project scope. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from local project files and external vulnerability APIs. It mitigates risks by employing strict report templates, redacting sensitive values, and performing evidence-based validation of all findings.
- [DATA_EXFILTRATION]: The skill queries several well-known technology and vulnerability services, including the OSV database, GitHub Advisory Database, npm Registry, and endoflife.date. It also includes an optional feature to upload the generated security report to a user-provided Google Drive folder.
Audit Metadata