next-dev-loop
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install or upgrade global software dependencies.
- Instructions include
npm i -g agent-browser@latestandpnpm next upgrade. - Fetches a usage guide at runtime via
agent-browser skills get core. - [COMMAND_EXECUTION]: The skill relies extensively on shell commands to manage the development environment and drive the browser.
- Executes
agent-browserwith various flags (--session,--restore,--headed) to automate browser interactions. - Uses
sedto process Server-Sent Events (SSE) data from the/_next/mcpendpoint. - [PROMPT_INJECTION]: The skill processes untrusted data from the application being developed, creating a surface for indirect prompt injection.
- Ingestion points: Data is read from the running application's DOM, console logs, and the Next.js
/_next/mcpmetadata endpoint (SKILL.md). - Boundary markers: No explicit boundary markers or instructions are provided to the agent to disregard instructions embedded within the application's runtime data.
- Capability inventory: The agent has the capability to execute shell commands (
agent-browser,npm), write to the filesystem, and perform network requests to the local dev server. - Sanitization: No explicit sanitization or filtering of the ingested application content is described.
Audit Metadata