nextjs-security-scan
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a well-structured security utility that uses local static analysis scripts and standard package manager tools to identify vulnerabilities. All included scripts (dependency-audit.sh, pattern-scanner.js, secret-scanner.js) perform their stated functions using standard APIs and do not exhibit suspicious behaviors.
- [DATA_EXPOSURE]: The secret-scanner.js script proactively protects user data by skipping real .env files by default and only analyzing template files (.env.example), preventing the accidental ingestion of live production secrets into the agent's context.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes untrusted code from a user's project, it uses dedicated scanning logic that treats file content as raw data to be matched against regex patterns, effectively isolating the agent from executing instructions embedded within the analyzed files.
Audit Metadata