next-partial-prefetching-optimizer
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Project Configuration Modification: The skill instructs the agent to programmatically update
next.config.tsto enable specific experimental testing APIs. This is a common pattern for developer tools but warrants review to ensure only intended changes are made to the codebase. - Environment Variable Gating: The suggested configuration changes use an environment variable (
EXPOSE_TESTING_API) to control the exposure of testing APIs. This follows security best practices by preventing accidental exposure in production environments unless the variable is explicitly toggled. - Shell Command Execution: The workflow involves executing standard build and test scripts such as
pnpm build,pnpm start, andpnpm playwright test. These commands rely on the project's localpackage.jsonconfiguration, which is a standard operational pattern for frontend development tools. - Dependency Management: The skill may recommend installing
@next/playwrightif it is missing from the project's dependencies. Users should verify that the installed version aligns with their project's requirements. - Production Safety Measures: The instructions include explicit warnings against enabling the
exposeTestingApiInProductionBuildflag for live production traffic, which helps mitigate risks associated with exposing internal application state. - Indirect Input Handling: The skill processes local project files like
package.jsonto determine build and test commands. While this is a functional requirement, users should ensure their project configuration is trusted when using the unattended workflow mode.
Audit Metadata