secure-nextjs-api-routes
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted request data (headers, URL) for security processing, representing a standard API attack surface. The implementation mitigates risks through robust sanitization.\n
- Ingestion points: Request headers (
x-forwarded-for,origin), URL (req.url), and request bodies are accessed inlib/security-middleware.tsandlib/rate-limiter.ts.\n - Boundary markers: The middleware functions as a logical boundary between the network and the application handler.\n
- Capability inventory: The skill performs database operations (
insert,select,delete) via the Supabase client based on request attributes.\n - Sanitization: Anonymous identifiers are hashed using SHA-256 in
lib/rate-limiter.ts, and CSRF tokens are generated using cryptographically secure random bytes inlib/csrf-protection.ts.\n- [SAFE]: The skill correctly implements security headers (e.g.,X-Content-Type-Options,X-Frame-Options) and follows industry-standard practices for CSRF protection and rate limiting.
Audit Metadata