next-partial-prefetching-optimizer

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Project Configuration Modification: The skill instructs the agent to programmatically update next.config.ts to enable specific experimental testing APIs. This is a common pattern for developer tools but warrants review to ensure only intended changes are made to the codebase.
  • Environment Variable Gating: The suggested configuration changes use an environment variable (EXPOSE_TESTING_API) to control the exposure of testing APIs. This follows security best practices by preventing accidental exposure in production environments unless the variable is explicitly toggled.
  • Shell Command Execution: The workflow involves executing standard build and test scripts such as pnpm build, pnpm start, and pnpm playwright test. These commands rely on the project's local package.json configuration, which is a standard operational pattern for frontend development tools.
  • Dependency Management: The skill may recommend installing @next/playwright if it is missing from the project's dependencies. Users should verify that the installed version aligns with their project's requirements.
  • Production Safety Measures: The instructions include explicit warnings against enabling the exposeTestingApiInProductionBuild flag for live production traffic, which helps mitigate risks associated with exposing internal application state.
  • Indirect Input Handling: The skill processes local project files like package.json to determine build and test commands. While this is a functional requirement, users should ensure their project configuration is trusted when using the unattended workflow mode.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 12:37 AM