Next.js Security Scan
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides utility scripts (
scripts/dependency-audit.sh,scripts/pattern-scanner.py,scripts/secret-scanner.py) to automate security checks. These scripts execute standard auditing commands such asnpm auditand perform local file analysis. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes untrusted local project files.
- Ingestion points: Source code files (
.ts,.tsx,.js,.jsx) and environment templates (.env.example) are read bypattern-scanner.pyandsecret-scanner.py. - Boundary markers: None identified in the processing logic.
- Capability inventory: The scripts read local files and execute package manager audit commands. No network exfiltration capabilities were found.
- Sanitization: Content is read and summarized in reports without explicit sanitization of potentially embedded instructions.
- [CREDENTIALS_UNSAFE]: While
secret-scanner.pyincludes patterns for various API keys and database strings, these are detection signatures for identifying vulnerabilities in audited projects rather than hardcoded credentials used by the skill.
Audit Metadata